Agent Permissions Index

npx add-mcp 'https://agent-permissions-index.vercel.app/mcp'

Snapshot 2026-10-20 · 16,096 public config files · 14,111 unique

85.6% of Claude Code permission configs have no deny rules.

We read public agent config files from GitHub and measured what developers let their coding agents do without asking: run any shell command, execute interpreters, delete files, fetch from the internet. Based on 4,831 unique Claude Code configs that set permissions; identical copies are counted once. Counting every file: 85.3% (4299/5041).

Share image

Safety leaderboard

Which agent tools have the safest public configs? Snapshot 2026-10-20, aggregate counts only.

#	Tool	Safety score	High-risk configs	Sample (unique)	Has deny rules
1	Claude Code	97.1	2.9% (170/5963, 95% CI 2.5–3.3%)	5,963 4,831 set permissions	11.6% (694/5,963; 14.4% of those setting permissions)
2	Gemini CLI	93.4	6.6% (91/1377, 95% CI 5.4–8%)	1,377 85 set permissionssmall sample	1.2% (17/1,377; 20% of those setting permissions)
3	Codex CLI	92.9	7.1% (298/4194, 95% CI 6.4–7.9%)	4,194 1,200 set permissions	n/a no deny setting
4	Cursorcredentials only	92.2	7.8% (112/1427, 95% CI 6.6–9.4%)	1,427	n/a no deny setting

A high score doesn't mean locked down. Deny rules are what stop an agent that decides to go further, and most configs have none.

Claude Code deny rules: team vs solo repos

Repo type	Configs	Any deny	.env	Secrets	git push	rm
Team (org-owned or 3+ contributors)	1,825	17.6%	7.9%	3.4%	6.6%	8.7%
Org-owned	798	21.2%	9.5%	4.3%	7.1%	9.8%
User-owned, 3+ contributors	1,027	14.9%	6.6%	2.7%	6.1%	7.8%
Solo	3,005	12.4%	6.5%	3%	5.7%	5.8%

Base: Claude Code configs with permissions (4,831; 1 with unknown ownership excluded). Team vs solo is a proxy: GitHub org ownership and contributor count (3+) don't always reflect how a repo is actually used.

Shared MCP config files (.mcp.json), not an agent: 1.9% (22/1,150) contain a credential-looking value.

How the score works: Score = 100 minus the % of unique public configs for that tool with at least one high-risk setting: full bypass / YOLO mode, unrestricted shell (any command, or Codex danger-full-access), or a hardcoded credential-looking value. Identical configs are counted once. Higher is safer. Cursor's mcp.json has no permission model, so Cursor can only fail on credentials; deny-rule coverage is shown for context but not scored, since only some tools support it.

A high score does not mean locked down. The score only counts settings that open the door wide (bypass, unrestricted shell, hardcoded credentials). Deny rules are what stop an agent that decides to go further, and most configs have none. "Has deny rules" = % of unique configs with at least one deny rule (Claude Code permissions.deny, Gemini CLI excludeTools). Codex and Cursor have no deny-list setting, so it is n/a for them. Not part of the score.

Small sample = fewer than 200 unique configs that set permissions (e.g. Gemini CLI, n=85); treat its permission-related numbers as rough. Ranges are 95% Wilson confidence intervals, so tools whose ranges overlap are effectively tied.

Full leaderboard and share image →

n = 1158/4831Every file: 23.7% (1194/5041)

n = 155/1200Every file: 12% (174/1449)

n = 134/2577Every file: 5.9% (170/2886)

By tool

Percentages use files that actually set permissions as the denominator.

Claude Code (.claude/settings*.json)

Share of 4,831 unique configs that set permissions (5,963 unique of 6,308 files parsed; 552 files were exact duplicates, largest cluster 5).

n = 4,831

Share image

Top MCP servers

48 files configure at least one MCP server.

Server	Files
@playwright/mcp	6
@modelcontextprotocol/server-github	5
@upstash/context7-mcp	4
@modelcontextprotocol/server-postgres	3
url:mcp.supabase.com	2
url:localhost	2
@modelcontextprotocol/server-filesystem	2
url:mcp.figma.com	2

Most-configured MCP servers

#	Server	Files
1	@upstash/context7-mcp	646
2	@playwright/mcp	624
3	url:localhost	438
4	@modelcontextprotocol/server-sequential-thinking	335
5	chrome-devtools-mcp	307
6	@modelcontextprotocol/server-github	301
7	@modelcontextprotocol/server-filesystem	246
8	boost:mcp	244
9	@modelcontextprotocol/server-memory	234
10	shadcn	176
11	url:mcp.context7.com	175
12	mcp-remote	160
13	url:mcp.supabase.com	155
14	url:api.githubcopilot.com	134
15	git+https://github.com/oraios/serena	119

Methodology & caveats

Full details on the methodology page. Fix your own setup with the guides for Claude Code permissions, Codex sandbox settings, Cursor mcp.json keys and Gemini CLI YOLO mode.

Not a random sample

Files come from GitHub code search results, split by file size, and only from public repos. Treat percentages as indicative.

Free: a hardened Claude Code settings.json

The A-grade file from our config pack. Enter your email and copy it in seconds.