Agent IndexAgent Permissions Index
Snapshot 2026-10-20 · 16,096 public config files · 14,111 unique

85.6% of Claude Code permission configs have no deny rules.

We read public agent config files from GitHub and measured what developers let their coding agents do without asking: run any shell command, execute interpreters, delete files, fetch from the internet. Based on 4,831 unique Claude Code configs that set permissions; identical copies are counted once. Counting every file: 85.3% (4299/5041).

Grade my configExplore the data
Share image
Safety leaderboard
Which agent tools have the safest public configs? Snapshot 2026-10-20, aggregate counts only.
#ToolSafety scoreHigh-risk configsSample (unique)Has deny rules
1Claude Code97.12.9% (170/5963, 95% CI 2.5–3.3%)5,963
4,831 set permissions
11.6%
(694/5,963; 14.4% of those setting permissions)
2Gemini CLI93.46.6% (91/1377, 95% CI 5.4–8%)1,377
85 set permissionssmall sample
1.2%
(17/1,377; 20% of those setting permissions)
3Codex CLI92.97.1% (298/4194, 95% CI 6.4–7.9%)4,194
1,200 set permissions
n/a
no deny setting
4Cursorcredentials only92.27.8% (112/1427, 95% CI 6.6–9.4%)1,427n/a
no deny setting

A high score doesn't mean locked down. Deny rules are what stop an agent that decides to go further, and most configs have none.

Shared MCP config files (.mcp.json), not an agent: 1.9% (22/1,150) contain a credential-looking value.

How the score works: Score = 100 minus the % of unique public configs for that tool with at least one high-risk setting: full bypass / YOLO mode, unrestricted shell (any command, or Codex danger-full-access), or a hardcoded credential-looking value. Identical configs are counted once. Higher is safer. Cursor's mcp.json has no permission model, so Cursor can only fail on credentials; deny-rule coverage is shown for context but not scored, since only some tools support it.

A high score does not mean locked down. The score only counts settings that open the door wide (bypass, unrestricted shell, hardcoded credentials). Deny rules are what stop an agent that decides to go further, and most configs have none. "Has deny rules" = % of unique configs with at least one deny rule (Claude Code permissions.deny, Gemini CLI excludeTools). Codex and Cursor have no deny-list setting, so it is n/a for them. Not part of the score.

Small sample = fewer than 200 unique configs that set permissions (e.g. Gemini CLI, n=85); treat its permission-related numbers as rough. Ranges are 95% Wilson confidence intervals, so tools whose ranges overlap are effectively tied.

Full leaderboard and share image →
Unique Claude Code configs with a wildcard interpreter
24%
n = 1158/4831Every file: 23.7% (1194/5041)
Unique Codex configs in full bypass mode
12.9%
n = 155/1200Every file: 12% (174/1449)
Unique MCP configs with a credential-looking literal
5.2%
n = 134/2577Every file: 5.9% (170/2886)

By tool

Percentages use files that actually set permissions as the denominator.

Claude Code (.claude/settings*.json)
Share of 4,831 unique configs that set permissions (5,963 unique of 6,308 files parsed; 552 files were exact duplicates, largest cluster 5).
n = 4,831
Share image
Top MCP servers
48 files configure at least one MCP server.
ServerFiles
@playwright/mcp6
@modelcontextprotocol/server-github5
@upstash/context7-mcp4
@modelcontextprotocol/server-postgres3
url:mcp.supabase.com2
url:localhost2
@modelcontextprotocol/server-filesystem2
url:mcp.figma.com2

Most-configured MCP servers

Across all tools · 5,700 unique configs with at least one MCP server
#ServerFiles
1@upstash/context7-mcp646
2@playwright/mcp624
3url:localhost438
4@modelcontextprotocol/server-sequential-thinking335
5chrome-devtools-mcp307
6@modelcontextprotocol/server-github301
7@modelcontextprotocol/server-filesystem246
8boost:mcp244
9@modelcontextprotocol/server-memory234
10shadcn176
11url:mcp.context7.com175
12mcp-remote160
13url:mcp.supabase.com155
14url:api.githubcopilot.com134
15git+https://github.com/oraios/serena119

Methodology & caveats

Full details on the methodology page. Fix your own setup with the guides for Claude Code permissions, Codex sandbox settings, Cursor mcp.json keys and Gemini CLI YOLO mode.