What is .docignore? Keeping internal files out of shared docs

When your documentation and your internal notes live in the same repo, sharing gets dangerous: how do you show a client the project docs without also exposing CLAUDE.md, secrets, or half-finished drafts sitting in the same folders? That's what a .docignore is for.

The definition

A **.docignore is a file that lists documentation paths to exclude from rendering, search, and MCP**. It uses the same glob syntax as .gitignore. Anything it matches is never shown in the portal, never appears in full-text search, and is never returned over the MCP server — for every user, regardless of role.

.docignore vs .gitignore

They look identical and serve parallel purposes for different systems:

The key insight: a file can be tracked by git (you want it versioned) but excluded from sharing via .docignore. Your internal docs stay in the repo with everything else and simply never leave the team.

What it looks like

# .docignore — never rendered, never indexed, never returned over MCP

# Agent/config files
CLAUDE.md
.cursorrules

# Secrets and credentials
**/secrets/**
*.env
*.key

# Work in progress
drafts/
*.internal.md

Why "never indexed" matters

There's a meaningful difference between hidden in the UI and never indexed. If a file is merely hidden, it can still leak through search or an AI agent's tool call. With Miradorly, .docignore-matched files are genuinely absent from the index — so they can't surface in portal search or in MCP results, no matter who asks or what role they have. The internal file effectively doesn't exist for any shared surface.

How it works across the three surfaces

In Miradorly, one .docignore governs all three places docs are exposed:

1. Portal — matched files aren't rendered.
2. Search — matched files aren't in the search index.
3. MCP — matched files are never returned to an AI agent (role-aware MCP).

One rule, every surface — so there's no gap where an internal file slips through one channel but not another.

Practical tips

• Put a .docignore at the repo root and add folder-level ones if needed.
• Exclude agent/config files (CLAUDE.md, .cursorrules) by default — clients don't need them and they can reveal internal process.
• Exclude drafts/ so work-in-progress never shows up as if it were finished.
• Review it when you add a new internal doc type.

Bottom line

.docignore is the small file that makes it safe to keep internal and client-facing docs in the same repo: it tells your portal and MCP what to never render, index, or return. Like .gitignore for the docs you share — and the reason you can connect a client (or their AI agent) to your documentation without leaking the parts that should stay internal.