Have you considered adding an optional argument per directory with a list of paths to exclude and disallow access to (for example, .git, .env, .idea, etc)? It could also support a .mcp_ignore file with the same format as .gitignore, recursively naming file patterns to skip.
What do you think? None of the filesystem MCP plugins seem to be able to skip files and the security implications are real.