Methodology
| Config file | Unique configs | With permission settings |
|---|---|---|
| Codex CLI (.codex/config.toml) | 4,194 | 1,200 (28.6%) |
| Claude Code (.claude/settings.json, settings.local.json) | 5,963 | 4,831 (81%) |
| Project .mcp.json | 1,150 | n/a |
| Gemini CLI (.gemini/settings.json) | 1,377 | 85 (6.2%) |
| Cursor (.cursor/mcp.json) | 1,427 | n/a |
Source
Public files found with GitHub code search, split by file size so more results are reachable. Each file is fetched read-only, parsed, measured and discarded. Snapshot 2026-10-20: 16,096 parsed files, 14,111 unique configs. Refreshed weekly (Mondays).
De-duplication
Each file is normalized (key order, whitespace, credential-looking values redacted) and hashed. Identical configs count once in headline numbers. Every-file and one-per-repo counts are kept as robustness checks and differ by about a point or less.
Bypass / YOLO
Claude Code: permissions.defaultMode = bypassPermissions. Gemini CLI: yolo, autoAccept or approvalMode yolo set in the file. Codex: approval_policy = never and sandbox_mode = danger-full-access (top level or in a profile).
Unrestricted shell
Claude Code: Bash, Bash(*) or Bash(*:*) in allow. Gemini CLI: run_shell_command or ShellTool without arguments in core/allowed tools. Codex: sandbox_mode = danger-full-access.
Wildcard interpreter (Claude Code)
An allow rule like Bash(python3:*), Bash(node *) or Bash(npx:*) for an interpreter or package runner, which can execute arbitrary code.
Deny rules
Claude Code: a non-empty permissions.deny. Gemini CLI: a non-empty excludeTools / tools.exclude. Codex has no equivalent list, so it is reported as 0%.
Credential-looking values
A field whose key looks like a secret (api_key, token, secret, password, auth, credential) and whose value is 16+ characters, mixes letters and digits, and isn't a ${VAR} reference or placeholder. Values are never stored, logged or tested. Expect false positives and misses.
Leaderboard score
Score = 100 minus the % of unique public configs for that tool with at least one high-risk setting: full bypass / YOLO mode, unrestricted shell (any command, or Codex danger-full-access), or a hardcoded credential-looking value. Identical configs are counted once. Higher is safer. Cursor's mcp.json has no permission model, so Cursor can only fail on credentials; deny-rule coverage is shown for context but not scored, since only some tools support it.
Limits
Not a random sample: GitHub search ranking decides what is returned, public repos skew toward templates, demos and dotfiles, and local settings files are usually gitignored. Tools have different permission models, so cross-tool comparisons are approximate. Small samples (Gemini CLI permission keys, n=85) are flagged.
Privacy
Rows are keyed by a salted hash of the repo. No repo names, usernames, paths or secret values are stored or published.
License and reuse
The aggregate statistics are published under CC BY 4.0. Cite "Agent Permissions Index" with a link. A plain-text summary is at /llms-full.txt, and agents can query it through the MCP server.
See the results: overview · leaderboard · guides