{"slug": "we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script", "title": "We counted ignore rules in 100 public AI and MCP repositories (no names, script included)", "summary": "A team of researchers surveyed 100 active public AI and MCP repositories on 2026-11-12 and found that while 97 had a root .gitignore, only 76 included an .env pattern and just 26 had a key-file or secrets pattern. Among the 30 repositories with a Dockerfile, 28 had a .dockerignore but 12 of those omitted an .env pattern, meaning local secrets could travel inside a pushed image layer. The team published its counting method and a standard-library Python script so others can reproduce the results.", "body_md": "A missing line in `.gitignore` is not a leak. But it is the first thing between a secret and a public history, so we wanted to know how often the basic lines are actually there.\n\nOn 2026-11-12 we took 100 active public AI and MCP repositories and counted. We did not judge, and we name no repository here or in any file we publish. Nothing was reported to anyone.\n\n**The page with every count, the method and the script: [https://zero-trace-ship-kit.zeus-lab-global.workers.dev/report/?utm_source=devto](https://zero-trace-ship-kit.zeus-lab-global.workers.dev/report/?utm_source=devto)**\n\n|  | Count | \n|---|---|\n| Have a `.gitignore` at the root | 97 / 100 | \n| Have an `.env` pattern in it | 76 / 100 | \n| Have a `.claude` /`settings.local.json` pattern in it | 59 / 100 | \n| Have a key-file or secrets pattern in it | 26 / 100 | \n| Have a `Dockerfile` at the root | 30 / 100 | \n| ...of those, have a `.dockerignore` | 28 / 30 | \n| ...of those, keep `.env` out of the build context | 18 / 30 | \n| ...of those, keep `.git` out of the build context | 21 / 30 | \n| Keep Claude Code settings in the repository ( `.claude/` ) | 12 / 100 | \n| ...of those, ignore the local settings file | 11 / 12 | \n| Have a file named `.env` on the default branch (existence only) | 1 / 100 | \n| Have `.claude/settings.local.json` on the default branch (existence only) | 2 / 100 | \n\nThe Docker rows. A `.dockerignore` is nearly always present when there is a `Dockerfile` (28 of 30), yet 12 of those 30 have no `.env` pattern in it. `.gitignore` keeps a file out of Git; it does not keep it out of `docker build .`. If an image built on a developer machine is pushed, a local `.env` can travel inside a layer. Whether it does depends on the `COPY` lines, which we did not read.\n\n`.env` may be a harmless placeholder.\nPublic, non-archived, non-fork repositories with at least 50 stars, pushed to within 30 days, from GitHub's public search for four topics (mcp, ai-agents, claude-code, llm), merged in turn until 100. For each repository two public files are read (`.gitignore`, `.dockerignore`) and five paths are checked for existence. No key, no account: Python standard library plus curl. The script is on the report page; run it and you get today's counts.\n\nThree lines cover most of it:\n\n```\n# .gitignore\n.env\n.env.*\n.claude/settings.local.json\n```\n\nand the same `.env` lines in `.dockerignore`. To see what a folder would give away before you publish it, the free scanner runs in the browser (the files are not uploaded) and the command-line edition is MIT: [https://zero-trace-ship-kit.zeus-lab-global.workers.dev/?utm_source=devto](https://zero-trace-ship-kit.zeus-lab-global.workers.dev/?utm_source=devto)\n\n*Disclosure: this article was drafted with AI assistance (Claude) and checked against the measured results and the published files. Product links lead to our own paid kits.*", "url": "https://wpnews.pro/news/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script", "canonical_source": "https://dev.to/zeuslab/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script-included-418p", "published_at": "2026-11-12 14:20:10+00:00", "updated_at": "2026-11-12 14:25:26.842332+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "agent-protocols"], "entities": ["GitHub", "Claude Code", "MCP", "Claude"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script", "markdown": "https://wpnews.pro/news/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script.md", "text": "https://wpnews.pro/news/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script.txt", "jsonld": "https://wpnews.pro/news/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script.jsonld"}}