AI coding agent config answers
Quick answers to common permission and secrets questions, with numbers from the 2026-10-20 snapshot of public configs. For full walkthroughs, see the guides.
Claude Code
- How to add deny rules in Claude Code (settings.json examples)
Add permissions.deny to .claude/settings.json to block reading .env files, git push and self-editing. 85.6% of public configs have none.
- How to stop Claude Code from reading your .env file
Add Read(./.env) and Read(./.env.*) to permissions.deny in .claude/settings.json. Only 7% of public Claude Code configs with permissions do.
- A safe Claude Code settings.json template (copy and paste)
A starting .claude/settings.json with allow, ask and deny lists. 24% of public configs allow a wildcard interpreter and 85.6% have no deny rules.
- Is it safe to commit .mcp.json? (API keys in MCP configs)
Committing .mcp.json is fine if it has no secrets. 1.9% of public project .mcp.json files and 7.8% of .cursor/mcp.json files contain a credential-looking value.
Codex CLI
- Is Codex full-auto safe? --full-auto vs --yolo explained
Codex's Auto preset keeps a sandbox, but --yolo / danger-full-access removes it. Full bypass: 12.9% of 1,200 configs that set permissions (155 configs; 3.7% of all 4,194 unique Codex configs).
- Codex sandbox modes explained: read-only, workspace-write, danger-full-access
What each Codex sandbox_mode allows and when to use it. 18% of public Codex configs that set permissions use danger-full-access.
Cursor
- How to keep API keys out of .cursor/mcp.json
Use ${env:NAME} or envFile instead of pasting tokens into Cursor's mcp.json. 7.8% of public .cursor/mcp.json files contain a credential-looking value.
Gemini CLI
- What is Gemini CLI YOLO mode? (and how to use it safely)
YOLO mode auto-approves every Gemini CLI tool call. 42.4% of public configs that set permission keys turned it on (small sample).
- Gemini CLI excludeTools examples: block shell commands and tools
Block tools with tools.exclude, MCP tools with excludeTools, and shell commands with a policy rule. 20% of public Gemini configs with permission keys block anything.