AI coding agent security leaderboard
Ranking the agent tools by how safely developers configure them in public GitHub repos. Refreshed weekly.
| # | Tool | Safety score | High-risk configs | Sample (unique) | Has deny rules |
|---|---|---|---|---|---|
| 1 | Claude Code | 97.1 | 2.9% (170/5963, 95% CI 2.5–3.3%) | 5,963 4,831 set permissions | 11.6% (694/5,963; 14.4% of those setting permissions) |
| 2 | Gemini CLI | 93.4 | 6.6% (91/1377, 95% CI 5.4–8%) | 1,377 85 set permissionssmall sample | 1.2% (17/1,377; 20% of those setting permissions) |
| 3 | Codex CLI | 92.9 | 7.1% (298/4194, 95% CI 6.4–7.9%) | 4,194 1,200 set permissions | n/a no deny setting |
| 4 | Cursorcredentials only | 92.2 | 7.8% (112/1427, 95% CI 6.6–9.4%) | 1,427 | n/a no deny setting |
A high score doesn't mean locked down. Deny rules are what stop an agent that decides to go further, and most configs have none.
Shared MCP config files (.mcp.json), not an agent: 1.9% (22/1,150) contain a credential-looking value.
How the score works: Score = 100 minus the % of unique public configs for that tool with at least one high-risk setting: full bypass / YOLO mode, unrestricted shell (any command, or Codex danger-full-access), or a hardcoded credential-looking value. Identical configs are counted once. Higher is safer. Cursor's mcp.json has no permission model, so Cursor can only fail on credentials; deny-rule coverage is shown for context but not scored, since only some tools support it.
A high score does not mean locked down. The score only counts settings that open the door wide (bypass, unrestricted shell, hardcoded credentials). Deny rules are what stop an agent that decides to go further, and most configs have none. "Has deny rules" = % of unique configs with at least one deny rule (Claude Code permissions.deny, Gemini CLI excludeTools). Codex and Cursor have no deny-list setting, so it is n/a for them. Not part of the score.
Small sample = fewer than 200 unique configs that set permissions (e.g. Gemini CLI, n=85); treat its permission-related numbers as rough. Ranges are 95% Wilson confidence intervals, so tools whose ranges overlap are effectively tied.
How scores are computed: methodology. Improve your score: Claude Code · Codex · Gemini CLI · Cursor guides.