Agent Permissions Index

npx add-mcp 'https://agent-permissions-index.vercel.app/mcp'

Snapshot 2026-10-26 · 18,652 public config files · 15,799 unique

84.3% of Claude Code permission configs have no deny rules.

We read public agent config files from GitHub and measured what developers let their coding agents do without asking: run any shell command, execute interpreters, delete files, fetch from the internet. Based on 5,559 unique Claude Code configs that set permissions; identical copies are counted once. Counting every file: 83.6% (4978/5952).

Share image

Safety leaderboard

Which agent tools have the safest public configs? Snapshot 2026-10-26, aggregate counts only.

#	Tool	Safety score	High-risk configs	Sample (unique)	Has deny rules
1	Claude Code	97.1	2.9% (201/6969, 95% CI 2.5–3.3%)	6,969 5,559 set permissions	12.5% (873/6,969; 15.7% of those setting permissions)
2	Gemini CLI	93.6	6.4% (96/1490, 95% CI 5.3–7.8%)	1,490 93 set permissionssmall sample	1.1% (17/1,490; 18.3% of those setting permissions)
3	Codex CLI	92.9	7.1% (311/4359, 95% CI 6.4–7.9%)	4,359 1,218 set permissions	n/a no deny setting
4	Cursorcredentials only	92.4	7.6% (117/1540, 95% CI 6.4–9%)	1,540	n/a no deny setting

A high score doesn't mean locked down. Deny rules are what stop an agent that decides to go further, and most configs have none.

Claude Code deny rules: team vs solo repos

Repo type	Configs	Any deny	.env	Secrets	git push	rm
Team (org-owned or 3+ contributors)	2,282	19.6%	9%	3.9%	7.5%	8.5%
Org-owned	1,027	23.3%	10.5%	4.7%	8.4%	9.6%
User-owned, 3+ contributors	1,255	16.6%	7.7%	3.2%	6.8%	7.6%
Solo	3,277	13%	6.8%	3%	5.9%	5.8%

Base: Claude Code configs with permissions (5,559). Team vs solo is a proxy: GitHub org ownership and contributor count (3+) don't always reflect how a repo is actually used.

Shared MCP config files (.mcp.json), not an agent: 1.9% (27/1,441) contain a credential-looking value.

How the score works: Score = 100 minus the % of unique public configs for that tool with at least one high-risk setting: full bypass / YOLO mode, unrestricted shell (any command, or Codex danger-full-access), or a hardcoded credential-looking value. Identical configs are counted once. Higher is safer. Cursor's mcp.json has no permission model, so Cursor can only fail on credentials; deny-rule coverage is shown for context but not scored, since only some tools support it.

A high score does not mean locked down. The score only counts settings that open the door wide (bypass, unrestricted shell, hardcoded credentials). Deny rules are what stop an agent that decides to go further, and most configs have none. "Has deny rules" = % of unique configs with at least one deny rule (Claude Code permissions.deny, Gemini CLI excludeTools). Codex and Cursor have no deny-list setting, so it is n/a for them. Not part of the score.

Small sample = fewer than 200 unique configs that set permissions (e.g. Gemini CLI, n=93); treat its permission-related numbers as rough. Ranges are 95% Wilson confidence intervals, so tools whose ranges overlap are effectively tied.

Full leaderboard and share image →

n = 1291/5559Every file: 22.6% (1348/5952)

n = 161/1218Every file: 12.6% (192/1521)

n = 144/2981Every file: 5.2% (183/3499)

By tool

Percentages use files that actually set permissions as the denominator.

Claude Code (.claude/settings*.json)

Share of 5,559 unique configs that set permissions (6,969 unique of 7,660 files parsed; 1,055 files were exact duplicates, largest cluster 10).

n = 5,559

Share image

Top MCP servers

55 files configure at least one MCP server.

Server	Files
@playwright/mcp	6
@modelcontextprotocol/server-github	5
@upstash/context7-mcp	4
@modelcontextprotocol/server-postgres	3
url:mcp.supabase.com	2
@anthropic-ai/mcp-playwright	2
url:ui.nuxt.com	2
url:nuxt.com	2

Most-configured MCP servers

#	Server	Files
1	@upstash/context7-mcp	686
2	@playwright/mcp	666
3	url:localhost	487
4	chrome-devtools-mcp	344
5	@modelcontextprotocol/server-sequential-thinking	343
6	@modelcontextprotocol/server-github	310
7	boost:mcp	257
8	@modelcontextprotocol/server-filesystem	254
9	@modelcontextprotocol/server-memory	237
10	shadcn	201
11	url:mcp.context7.com	193
12	mcp-remote	169
13	url:mcp.supabase.com	166
14	url:api.githubcopilot.com	148
15	next-devtools-mcp	121

Methodology & caveats

Full details on the methodology page. Fix your own setup with the guides for Claude Code permissions, Codex sandbox settings, Cursor mcp.json keys and Gemini CLI YOLO mode.

Not a random sample

Files come from GitHub code search results, split by file size, and only from public repos. Treat percentages as indicative.

Free: a hardened Claude Code settings.json

The A-grade file from our config pack. Enter your email and copy it in seconds.