Respect gitignore for search in Grok Build

Search and read tools can include gitignored paths unless you turn filtering on. Official switches live in the settings reference. Default for [tools] respect_gitignore is false.

Turn filtering on

Environment (process-scoped; overrides config when set):

export GROK_RESPECT_GITIGNORE=1

Set 0 to force filtering off for that process.

Or in user ~/.grok/config.toml / $GROK_HOME/config.toml:

[tools]
respect_gitignore = true

Project .grok/config.toml only contributes MCP, plugins, and permission rules — put [tools] in the user config.

What it affects

When filtering is on, search and read tools skip gitignored files. It does not replace permission deny rules or the sandbox. Pair it with Configure Grok Build permissions and Enable Grok Build sandbox when the tree has secrets under ignore patterns.

Confirm

grok inspect

Check that tool settings match what you set, then run a search that would otherwise hit an ignored path (for example node_modules or a local .env listed in .gitignore).

Pitfalls

• Leaving respect_gitignore off is the documented default; ignored build artifacts and local env files stay visible to search/read until you enable it.
• GROK_RESPECT_GITIGNORE wins over [tools] respect_gitignore for that process.
• Filtering only covers gitignore rules the tools honor — it is not a kernel deny list. Use sandbox deny globs for paths that must stay unreachable after an approve.