$19 · one-time

Safe Agent Config Pack

Hardened, commented configs for Claude Code, Codex CLI, Cursor and Gemini CLI, plus a pre-commit hook that catches API keys before they reach your repo. Copy them in, adjust a few script names, done.

85.6%

of Claude Code configs that set permissions have no deny rule at all

7.8%

of public Cursor mcp.json files contain a literal credential

12.9%

of Codex configs with permissions run in full bypass mode

From the Agent Permissions Index snapshot of 2026-10-20. See the methodology.

What's inside

Claude Code settings.json: Deny rules for .env, secrets, keys and cloud credentials; blocks rm -rf, sudo, curl, git push; stops the agent editing its own .claude/ rules. Grades A (100) on our grader.
Codex CLI config.toml: Approvals on request, workspace-only writes, network off in the sandbox, and credentials stripped from the shell environment.
Cursor mcp.json: Every MCP credential as an ${env:VAR} reference, so the file is safe to commit.
Gemini CLI settings.json: YOLO mode disabled, sandbox on, risky shell commands excluded, MCP servers not auto-trusted.
Pre-commit hook: Blocks commits that put OpenAI, Anthropic, GitHub, AWS, Google or Slack keys (or private keys) into agent config files and .env.
README: Two-minute install steps and a plain-English explanation of every rule, so you can adjust it.

Honest note

Everything here is built on public docs, and the free grader already gives you a safer config for one file. The pack saves you the time of doing all four tools properly, with explanations and a secrets hook. Deny rules reduce risk; they don't replace reviewing what your agent does.

Get the pack

Zip download. Use it in all your own and your team's projects.

Buy for $19

Want someone to do it for your repo? Get a config review.