Matt Hager

Building Agent Permissions Index, which tracks how safely 14k Al coding agents are set up. 85% of Claude Code configs have zero deny rules. Grade yours 👇

[Matt Hager @itsmatthager]

@topxea Surprised me too. Bypass is rare, but 86% of Claude Code configs that set permissions still have no deny rules. So the risk is less about people turning on scary modes and more about nobody setting limits.

[Matt Hager @itsmatthager]

Which AI coding agent do people set up most safely?

I ranked them using ~14,000 unique public configs on GitHub (higher = safer):

Claude Code: 97.1

Gemini CLI: 93.4 (small sample)

Codex CLI: 92.9

Cursor: 92.2

But 85% of Claude Code configs still have zero deny rules.

Full leaderboard, updated weekly, plus an MCP so your agent can grade its own config:
https://t.co/pJPfKYqgaj"

[Matt Hager @itsmatthager]

Agreed, and the data backs you up. The score already docks broad allows like unrestricted shell and wildcard interpreters. Explicit denies are rare too: only 8.7% of team Claude Code configs deny rm and 6.6% deny git push. A repo config can't show whether someone runs in a container or worktree, though, so that's out of view.

[Matt Hager @itsmatthager]

@SingulantChain Ran the split. Team repos (org-owned or 3+ contributors) add deny rules more often: 17.6% vs 12.4% for solo, and 21% for org repos. Still, out of 4,831 configs only 5 cover .env, secrets, .claude, push and rm.

[Matt Hager @itsmatthager]

Good question, and I don't have that split yet. The index only looks at the config files, not who owns the repo. What I can say: of the 694 Claude Code configs with any deny rule, only 5 cover .env, secrets, .claude, git push and rm together. Team vs solo is a good next cut, adding it.

[Matt Hager @itsmatthager]

Kind of, yeah. The score docks configs for risky things they turn on, like bypass mode, unrestricted shell and wildcard interpreters. Very few Claude Code configs do that (46 of 5,963 use bypass), so it scores high. That's why the leaderboard now shows deny-rule coverage next to the score. Claude Code is only 14.4%.

[Matt Hager @itsmatthager]

@ChenChaim42853 Fair, the denominator changes the story. 155 Codex configs run in full bypass. That's 12.9% of the 1,200 that set permissions, but only 3.7% of all 4,194 unique Codex configs. I'll make that clearer on the site.

[Matt Hager @itsmatthager]

I scanned ~16,000 public Al coding agent configs on GitHub.

85% of Claude Code configs that set permissions have zero deny rules.

12% of Codex configs run in full bypass mode.

9% of Cursor MCP files contain what looks like a hardcoded credential. Live index, updated weekly, plus a free grader for your own config:

https://t.co/XJNLOFadfT

[Matt Hager @itsmatthager]

@Tanguyvbc Exactly. If you add one deny rule, make it Edit(./.claude/**). Otherwise the agent can quietly change the rules it's supposed to follow.

[Matt Hager @itsmatthager]

@gagu_sh Agreed. Branch protection is the part the agent can't edit. Deny git push in the config, and protect the branch so even a push that slips through still needs a review and a green build.

[Matt Hager @itsmatthager]

@aleckloss Yep, allows count. Broad ones like Bash(*) or bypass modes cost points, a tight allowlist doesn't. Deny rules get their own column since that's the bigger gap. You can paste yours here and see the breakdown: https://t.co/PuQ6qNyK4D

[Matt Hager @itsmatthager]

@cryptojezuz Good rule, but CLAUDE.md is a request, not a lock. Put it in settings.json as a deny rule on .env and key files. Only 7% of 4,831 public Claude Code configs with permissions do that today.

[Matt Hager @itsmatthager]

@Synthexfr The missing step is the deny list. I scanned ~14k public agent configs and 86% have none. I put my safe defaults for Claude, Codex, Cursor and Gemini into one pack: https://t.co/GObRWwdjZA

[Matt Hager @itsmatthager]

@thedelost Good one. While you're in .claude/settings.json, add a deny block too. Only 7% of 4,831 public Claude Code configs with permissions deny .env and 6% deny git push. Hooks plus deny rules is the combo. Free checker: https://t.co/PuQ6qNyK4D

[Matt Hager @itsmatthager]

@fluixoo This. "Be careful" in a prompt isn't a permission. Out of 4,831 public Claude Code configs with permissions, only 6.9% actually deny rm and 6% deny git push. Only 5 cover .env, secrets, .claude, push and rm together.

[Matt Hager @itsmatthager]

@akshay_pachaar Shared memory across agents is great until it remembers your .env too. I scanned 4,831 public Claude Code configs: only 7% deny reading .env. Worth pairing this with a deny list before agents start learning from each other.

[Matt Hager @itsmatthager]

@rfdslabs Classic. Denying rm alone doesn't hold if find/xargs or a wildcard interpreter is allowed. 24% of public Claude Code configs allow something like Bash(python3:*), which gets around any command deny.

[Matt Hager @itsmatthager]

@rcom1337 Running skip-permissions unattended for months is the scary part. Of 4,831 public Claude Code configs that set permissions, only 31 stop the agent from editing its own .claude settings. Worth a deny on that plus .env at minimum.

[Matt Hager @itsmatthager]

@Voxyz_ai Good call. Repos leak them too: 7.8% of public .cursor/mcp.json files I scanned (112 of 1,427) have what looks like a real API key committed. ${env:NAME} instead of the literal value fixes it.

[Matt Hager @itsmatthager]

@milan_milanovic One more for the list: deny rules. 85.6% of public Claude Code configs with a permissions block have zero deny entries, so .env, git push and rm are all open by default.

[Matt Hager @itsmatthager]

@JoePro Agreed. Of the 694 Claude Code configs that do have deny rules, only 5 cover all five basics: .env, secrets paths, .claude settings, git push and rm. Most deny lists have a hole somewhere.