diff --git a/internal/server/handlers_file.go b/internal/server/handlers_file.go
index 9bb08e8..4d18952 100644
--- a/internal/server/handlers_file.go
+++ b/internal/server/handlers_file.go
@@ -61,7 +61,10 @@ func (s *Server) handleFileSearch(ctx context.Context, request mcp.CallToolReque
 		prefsMaxResults = prefs.DefaultMaxResults
 		prefsCluster = prefs.DefaultCluster
 	}
-	maxResults := effectiveInt(request, "max_results", prefsMaxResults, 0)
+	// Default to the configured cap (not 0/unbounded) so a broad pattern can't
+	// flood memory and the context window; an explicit max_results still wins,
+	// and the cursor footer lets the caller page through the rest.
+	maxResults := effectiveInt(request, "max_results", prefsMaxResults, s.cfg.MaxSearchResults)
 	cluster := effectiveBool(request, "cluster", prefsCluster, false)
 
 	cursorStr := request.GetString("cursor", "")
@@ -97,13 +100,14 @@ func (s *Server) handleFileSearch(ctx context.Context, request mcp.CallToolReque
 	}
 
 	req := &search.Request{
-		Pattern:      pattern,
-		Paths:        paths,
-		FileTypes:    fileTypes,
-		IgnoreCase:   ignoreCase,
-		Regex:        regex,
-		ContextLines: contextLines,
-		MaxResults:   rgMaxResults,
+		Pattern:       pattern,
+		Paths:         paths,
+		FileTypes:     fileTypes,
+		IgnoreCase:    ignoreCase,
+		Regex:         regex,
+		ContextLines:  contextLines,
+		MaxResults:    rgMaxResults,
+		IncludeHidden: request.GetBool("include_hidden", false),
 	}
 
 	results, err := s.searcher.Search(ctx, req)
diff --git a/internal/server/server.go b/internal/server/server.go
index 13576da..72324dc 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -129,6 +129,9 @@ func (s *Server) registerTools() {
 				mcp.WithBoolean("ignore_case",
 					mcp.Description("Case insensitive search"),
 				),
+				mcp.WithBoolean("include_hidden",
+					mcp.Description("Search hidden files and directories (dotfiles like .github/). Default: false."),
+				),
 				mcp.WithBoolean("regex",
 					mcp.Description("Treat pattern as regex (default: true)"),
 				),