agentaudit

agentaudit reads a repository's AI coding agent configuration and reports what it can do: the hooks, MCP servers, credential helpers, environment variables, permission and sandbox settings an agent picks up when it opens the repository. It only reads configuration; it never runs or modifies it.

It currently supports Claude Code, Codex and Cursor.

Install

With Go

go install github.com/manifold-security/agentaudit/cmd/agentaudit@latest

go install needs Go 1.26.0 or later.

From a release archive

Download the archive for your platform and SHA256SUMS from Releases, or with the GitHub CLI as below. Check the checksum and the attestation before you run the binary.

macOS

On an Intel Mac, replace darwin_arm64 with darwin_amd64.

gh release download -R manifold-security/agentaudit -p agentaudit_darwin_arm64.tar.gz -p SHA256SUMS
shasum -a 256 --ignore-missing -c SHA256SUMS
gh attestation verify agentaudit_darwin_arm64.tar.gz --repo manifold-security/agentaudit --signer-workflow manifold-security/agentaudit/.github/workflows/release.yml
tar -xzf agentaudit_darwin_arm64.tar.gz agentaudit
mkdir -p ~/.local/bin && mv agentaudit ~/.local/bin/

If macOS refuses to run it, clear the quarantine mark: xattr -d com.apple.quarantine ~/.local/bin/agentaudit.

If ~/.local/bin is not on your PATH, add this line to your shell profile:

export PATH="$HOME/.local/bin:$PATH"

Linux

On arm64, replace linux_amd64 with linux_arm64.

gh release download -R manifold-security/agentaudit -p agentaudit_linux_amd64.tar.gz -p SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
gh attestation verify agentaudit_linux_amd64.tar.gz --repo manifold-security/agentaudit --signer-workflow manifold-security/agentaudit/.github/workflows/release.yml
tar -xzf agentaudit_linux_amd64.tar.gz agentaudit
mkdir -p ~/.local/bin && mv agentaudit ~/.local/bin/

If ~/.local/bin is not on your PATH, add this line to your shell profile:

export PATH="$HOME/.local/bin:$PATH"

Windows

In PowerShell:

gh release download -R manifold-security/agentaudit -p agentaudit_windows_amd64.zip -p SHA256SUMS
(Get-FileHash -Algorithm SHA256 .\agentaudit_windows_amd64.zip).Hash.ToLower() -eq ((Select-String -Path SHA256SUMS -SimpleMatch 'agentaudit_windows_amd64.zip').Line -split '\s+')[0]
gh attestation verify agentaudit_windows_amd64.zip --repo manifold-security/agentaudit --signer-workflow manifold-security/agentaudit/.github/workflows/release.yml
Expand-Archive .\agentaudit_windows_amd64.zip -DestinationPath agentaudit
Unblock-File .\agentaudit\agentaudit.exe

The second line must print True. Then move agentaudit\agentaudit.exe to a directory on your PATH.

From source

make build                          # builds dist/agentaudit
mkdir -p ~/.local/bin && mv dist/agentaudit ~/.local/bin/

Quick start

Scan a repository from anywhere by naming it, or cd into it and run the command with no argument:

agentaudit /path/to/repo
cd /path/to/repo && agentaudit
agentaudit https://github.com/wshobson/agents

A GitHub URL scans a public repository without cloning it.

Sample output, from agentaudit testdata/malicious/claude-guardrail in this repository:

agentaudit · testdata/malicious/claude-guardrail

(claude-code)
permissions:
  mcpApproval enableAllProjectMcpServers · true · .claude/settings.json:enableAllProjectMcpServers
  mcpApproval enabledMcpjsonServers · memory · .claude/settings.json:enabledMcpjsonServers[0]
  permissionMode · acceptEdits · .claude/settings.json:permissions.defaultMode

sandbox:
  sandbox · /var/run/docker.sock · .claude/settings.json:sandbox.network.allowUnixSockets[0]
  sandbox · /tmp/app.sock · .claude/settings.json:sandbox.network.allowUnixSockets[1]

5 capabilities · 1 file · 2 categories

What it reports

Findings are grouped by agent ((claude-code), (codex), (cursor)), then by category. Each line is one capability: what it is, the value it carries, and where it is declared (file and key). The footer counts the capabilities, the files they came from, and the categories.

A finding's id in the JSON and Markdown reports is a hash over the scanned value, so a published report can confirm a guessed weak secret. The ids are kept stable on purpose.

A repository whose agent configuration yields nothing prints no capabilities found followed by the agents it scanned; one with no agent configuration at all prints no known agent config read.

Under --global-config, a home directory with no agent configuration prints no user-level agent config found, and one that exists but cannot be opened prints user-level agent config could not be read.

Exit codes: 0 no findings and every source read, 1 at least one finding, a source the scan could not read or parse (SCAN INCOMPLETE), a home directory --global-config could not open, a file a scan limit refused or a file a URL fetch withheld, 2 usage or runtime error. A refused file is named in a warning on stderr; when the limit that refused it has a flag below, a closing hint: line names that flag.

Flags

Usage: agentaudit [PATH | URL]. PATH defaults to the current directory. URL is https://github.com/<owner>/<repo>[/tree/<ref>[/<path>]], fetched anonymously over the network and held in memory; the fetch has a 120 s limit, and the report header reads github.com/<owner>/<repo>[/tree/<ref>[/<path>]]@<commit>, the commit cut to 12 characters.

Examples

Show the rule behind each finding:

$ agentaudit -v testdata/malicious/claude-guardrail
...
permissions:
  mcpApproval enableAllProjectMcpServers · true · .claude/settings.json:enableAllProjectMcpServers
    claude.mcp.auto-approve — MCP auto-approve bypasses the per-server approval prompt — https://code.claude.com/docs/en/settings
...

Print JSON for another tool to consume:

agentaudit -o json /path/to/repo

Print the report and also save JSON and Markdown copies:

agentaudit -O all /path/to/repo   # writes ./agentaudit-report.json and ./agentaudit-report.md

Scan every project under a directory:

agentaudit -r /path/to/projects

Scan two repositories in one run:

agentaudit /path/to/repo --scan-dir /path/to/other-repo

Scan only your own user-level agent configuration:

agentaudit --global-config

Admit a user-level config larger than the default file limit:

agentaudit --global-config --max-file-size 4MiB

Library usage

Import github.com/manifold-security/agentaudit to scan from Go. A scan reads through an fs.FS; for a directory on disk, pass an os.Root's FS, which keeps reads inside the directory. This scans the sample fixture in this repository:

root, err := os.OpenRoot("testdata/malicious/claude-guardrail")
if err != nil {
	log.Fatal(err)
}
defer root.Close()

report, err := agentaudit.New().Scan(root.FS())
if err != nil {
	log.Fatal(err)
}
for _, f := range report.Findings() {
	fmt.Println(f.RuleID, f.Digest())
}
fmt.Println("unreadable:", report.UnreadableSources(), "unparsed:", report.UnparsedSources())

The Go API is pre-1.0, so a release may change it.

Supported platforms

License

Apache-2.0. See LICENSE and NOTICE.