AI agent permission right-sizer
Paste the config of a coding agent or its MCP servers. You get what it is allowed to do, the grants that carry risk, ranked by severity, and a tighter version to copy, with the reason for every change. Add a usage export and it also marks the grants that were never used.
Your config never leaves your browser. The analysis runs in this page's own JavaScript. Nothing you paste or drop is sent to any server or stored, and nothing is kept after you close the tab. The page counts clicks on Analyze for its own statistics; that count carries no content.
Check a config
Results
Risk flags
Granted capabilities
Right-sized suggestion
Granted vs used
Right-size continuously from real usage across your fleet
This page compares one config with one usage export. With MoorAI, the opt-in allow trail sends the console one content-free record for each tool call an agent was allowed to make (the tool name, never its arguments) from every enrolled device, and the hook on each device enforces the allow, ask and deny decisions before a call runs.
What it checks
37 rules, each reading only the config you paste. The tool runs nothing from the config and contacts nothing it names.
Scroll sideways →
| Severity | Flag | Applies to | Raised when |
|---|---|---|---|
| Critical | Permission prompts are bypassed | Claude Code | defaultMode is bypassPermissions: every tool call runs without asking. |
| Critical | Any shell command runs without a prompt | Claude Code, Gemini CLI | Bash, Bash(*) or a bare run_shell_command is auto-approved. |
| Critical | A secret-looking value is in your config | every format | An env value, header, URL or argument looks like a key or token. Only the key name is shown. |
| Critical | Codex runs without a sandbox | Codex | sandbox_mode is danger-full-access, in the file or a profile. |
| High | The bypass-mode warning is switched off | Claude Code | skipDangerousModePermissionPrompt is true. |
| High | An interpreter or package runner is auto-approved | Claude Code, Gemini CLI | python, node, sh, npx, eval and the like run any code their arguments contain. |
| High | A network tool is auto-approved | Claude Code, Gemini CLI | curl, wget, ssh, scp, nc and the like can move data off the machine. |
| High | Privilege escalation is auto-approved | Claude Code, Gemini CLI | sudo, su, doas or runas. |
| High | A shell rule starts with a wildcard | Claude Code | A rule such as Bash(* --version) matches any program. |
| High | File edits outside the project are auto-approved | Claude Code | An Edit or Write allow rule anchored at // or ~/. |
| High | Your home or root directory is in the agent's reach | Claude Code, Codex, MCP servers | additionalDirectories, writable_roots or a server's path argument is / or a home directory. |
| High | Every project MCP server is approved automatically | Claude Code | enableAllProjectMcpServers is true, so a cloned repository's .mcp.json starts its servers. |
| High | An MCP server is fetched unpinned | every MCP format | npx -y, uvx, bunx or pnpm dlx with no exact version runs whatever is published today; a container with no tag or :latest likewise. |
| High | An MCP server skips every confirmation | Gemini CLI | trust is true on the server. |
| High | All hooks are switched off | Claude Code, Gemini CLI | disableAllHooks is true, or hooksConfig.enabled is false. |
| High | Codex never asks for approval | Codex | approval_policy is never, in the file or a profile. |
| Medium | A whole command family is auto-approved | Claude Code, Gemini CLI | git *, docker *, kubectl *, aws * and the like allow every subcommand, including the destructive ones. |
| Medium | A destructive command is auto-approved | Claude Code, Gemini CLI | rm, git push, git reset, chmod, kubectl delete, terraform apply and the like. |
| Medium | File reads outside the project are auto-approved | Claude Code | A Read allow rule anchored at // or ~/. |
| Medium | Every web fetch runs without a prompt | Claude Code, Gemini CLI | WebFetch or WebFetch(domain:*) is allowed, or web_fetch is in tools.allowed. |
| Medium | No deny rule protects secret files | Claude Code | Nothing denies reads of .env files, ~/.ssh or cloud credentials. |
| Medium | Every tool of an MCP server runs without a prompt | Claude Code | mcp__server or mcp__server__* is allowed (high when the server can run commands or holds credentials). |
| Medium | An MCP server can run commands | every MCP format | Its name, package or arguments point at a shell, terminal or code runner. |
| Medium | A remote MCP server is reached over plain HTTP | every MCP format | An http:// URL that is not localhost. |
| Medium | Sandboxed commands may reach any host | Claude Code | sandbox.network.allowedDomains contains *. |
| Medium | Sandboxed commands have network access | Codex | sandbox_workspace_write.network_access is true. |
| Medium | File edits are auto-approved | Gemini CLI | general.defaultApprovalMode is auto_edit. |
| High | Hidden characters in a rules file | Cursor rules | Unicode tags, bidirectional controls or zero-width characters a reviewer cannot see. |
| Medium | The rule tells the agent to fetch or run something | Cursor rules | curl, wget, a pipe to a shell, or an instruction to download or execute. |
| Low | File edits are accepted without a prompt | Claude Code | defaultMode is acceptEdits. |
| Low | A classifier approves actions instead of you | Claude Code | defaultMode is auto. |
| Low | Extra directories are in the agent's reach | Claude Code, Codex | additionalDirectories or writable_roots outside the project. |
| Low | No pre-tool hook checks calls before they run | Claude Code, Codex, Gemini CLI | Only the permission rules stand between the model's decision and the action. |
| Low | Every environment variable reaches commands | Codex | shell_environment_policy.inherit is all. |
| Low | Live web search is on | Codex | web_search is live. |
| Low | YOLO mode is not disabled | Gemini CLI | security.disableYoloMode is not true, so --yolo still auto-approves everything. |
| Info | This rule is added to every chat | Cursor rules | alwaysApply is true. |
Supported formats and sources
Each format is read to its vendor's documented schema:
- Claude Code settings.json: documentation ↗
- Claude Code ~/.claude.json: documentation ↗
- Claude Code .mcp.json: documentation ↗
- Claude Desktop claude_desktop_config.json: documentation ↗
- Cursor mcp.json: documentation ↗
- Cursor rule (.cursor/rules/*.mdc): documentation ↗
- Codex config.toml: documentation ↗
- Gemini CLI settings.json: documentation ↗
- Claude Code permission rules (modes, rule syntax, path anchors, WebFetch domains, MCP rule names): documentation ↗
Codex config.toml is read by a small TOML parser built into this page, so no library is loaded from anywhere. MCP server scope (filesystem, network, credentials, cloud, command execution, database) is inferred from each server's command, arguments, name and environment-variable names. Their values are never shown; a value is only tested for whether it looks like a key or token.
Limits
- One file at a time. Claude Code merges managed, user, project and local settings, and Codex and Gemini CLI layer theirs too, so a rule in another file can change the picture.
- Rules match command text. Claude Code's own documentation notes that a deny rule does not match a program run by its full path or inside
sh -c; a sandbox or a hook that reads the parsed command closes that gap. - Usage is tool-level. Allow-trail records carry the tool name, not its arguments, so a
Bash(...)rule is marked used when the agent ran any shell command. - MCP scope is inferred from names and arguments, and can be wrong for a server with an unhelpful name.
- The suggestion is a starting point. Placeholders such as
<version>are yours to fill in, and a tightened config should be tried on real work before it is rolled out.
Background: permission right-sizing, least privilege for AI agents, excessive agency and MCP in the glossary.