Research · 26 October 2026
State of AI agent permissions 2026.
We read 2,511 public agent configuration files on GitHub, from MCP configs to Claude Code, Codex and Gemini CLI settings, and graded each one with our own scanner. Most agents can do more than their owners have written rules for.
Snapshot taken 26 October 2026. Public repositories only, aggregates only: no repo, person or secret is named. How we did it · Download the data (CSV)
74%
of Claude Code settings files have no hook that checks a tool call before it runs (297 of 399).
Five findings.
-
74% of Claude Code settings files have no hook that checks a tool call before it runs.
297 of 399 .claude/settings.json files define no PreToolUse hook, and 94% have no “ask” rule, so nothing in the file makes the agent stop for a person.
-
11% of MCP configs connect a database server with no read-only setting.
185 of 1,702 files that declare MCP servers. Supabase’s server is the most common database server: 90 files, 12 of them set to read-only. Leaving out the archived Postgres reference server, it is still 9.6%.
-
About 1 in 8 Cursor MCP configs holds a credential that looks real, in plain text.
49 of 399 .cursor/mcp.json files (12.3%). Across all 2,511 files it is 99 (3.9%). We counted them and kept no value.
-
9% of Claude Code settings and 8% of Codex configs let the agent run shell commands with no guard.
A blanket or interpreter-wide Bash allow rule, or bypassPermissions, with no PreToolUse hook and no Bash deny rule: 34 of 399. In Codex: danger-full-access, or approval “never” without a read-only sandbox: 33 of 398 (4.8% set danger-full-access).
-
Our own grade gave 97% of files an A, and that is the point.
deedglass scan graded 2,429 of 2,511 files A and none D or F. Yet 14% of the A-graded MCP configs (232 of 1,620) still had one of the three risks above. A config file names a server, not what its credential can reach.
The headline numbers.
Each bar is a share of the files it names. The count is beside it.
By kind of file.
Project MCP files and Cursor configs carry the most database access and the most plaintext credentials. Settings files for coding agents carry the shell risk.
| File | Files | Writable database | Shell, no guard | Plaintext credential | Grade below A |
|---|---|---|---|---|---|
| Project .mcp.json | 400 | 13.0% (52) | 1.5% (6) | 3.2% (13) | 6.0% (24) |
| Cursor .cursor/mcp.json | 399 | 16.5% (66) | 1.8% (7) | 12.3% (49) | 6.5% (26) |
| Claude Desktop config | 391 | 4.1% (16) | 2.6% (10) | 2.0% (8) | 4.6% (18) |
| Other mcp.json | 126 | 7.9% (10) | 0.0% (0) | 3.2% (4) | 2.4% (3) |
| Claude Code .claude/settings.json | 399 | 0.5% (2) | 8.5% (34) | 1.0% (4) | 0.0% (0) |
| Codex .codex/config.toml | 398 | 3.8% (15) | 8.3% (33) | 0.5% (2) | 1.5% (6) |
| Gemini CLI .gemini/settings.json | 398 | 6.0% (24) | 0.3% (1) | 4.8% (19) | 1.3% (5) |
A settings file for Claude Code, Codex or Gemini CLI often declares no MCP server, so its database and credential numbers are low by nature. Codex and Gemini CLI files were graded on the MCP servers they declare.
The MCP servers that can change things.
The most common servers in the sample that can write to a database, drive a browser, edit files, change cloud resources, move money or run commands. Counts are files out of the 1,702 that declare any MCP server.
“Read-only” means a read-only flag or URL setting in the config. Browser and file servers have no such setting in most cases. The Postgres reference server runs queries in a read-only transaction that a query can end, and it is archived, so it counts as writable here.
Claude Code settings, up close.
399 .claude/settings.json files. Most allow a few commands and stop there: no hook, no ask, no deny.
The Deedglass grade.
Every file graded by deedglass scan 0.11.0, the same grade explained on /score.
The grade only takes points off for write paths it can name: servers in its catalogue, database URLs in a config, destructive database commands with no rule. It can’t see what a credential is allowed to do. That is why 14% of A-graded MCP configs still carry one of the three risks.
What the plaintext credentials were.
99 files held at least one. We matched known key formats and long random values in variables named like keys, and threw out placeholders. Values were never recorded.
| Looks like | Files |
|---|---|
| A long random value in a variable named like a key, token or secret | 88 |
| An OpenAI or Anthropic style key | 12 |
| A signed JWT (often a Supabase service or anon key) | 11 |
| A database URL with a password, to a remote host | 6 |
| A Google API key | 5 |
| A GitHub token | 4 |
| Another vendor’s key format | 4 |
| A database URL with a password, to a local host | 2 |
| An AWS access key | 1 |
How we did it.
- Find. On 26 October 2026 we ran GitHub’s code search for seven kinds of file: project .mcp.json, .cursor/mcp.json, claude_desktop_config.json, other mcp.json, .claude/settings.json, .codex/config.toml and .gemini/settings.json, read-only, through the public API.
- Sample. We kept exact file paths only (no templates or examples), one file per repository per kind, and each distinct file once. Up to 400 files per kind were drawn at random from what search returned. 2,528 files were fetched; 17 didn’t parse, leaving 2,511.
- Grade. Each file was placed alone in an empty folder and graded with deedglass scan 0.11.0, with no home folder so nothing from our machine was read. Codex and Gemini CLI files were converted to the same MCP server list first.
- Measure. A small script read the permission settings: database MCP servers and any read-only flag, shell servers, Bash allow and deny rules, hooks, Codex sandbox and approval settings, and credentials. Only the counts were kept. The fetched files were deleted after the run.
What each measure means.
- Writable database
- A database MCP server (Postgres, Supabase, MySQL, SQLite, MongoDB, Neon, Firebase and similar, by package and server name) with no read-only flag or setting in the config.
- Shell with no guard
- A shell or command MCP server not routed through a gateway; in Claude Code, a blanket or interpreter-wide Bash allow rule or bypassPermissions with no PreToolUse hook and no Bash deny rule; in Codex, danger-full-access, or approval “never” without a read-only sandbox; in Gemini CLI, YOLO mode or an allowed shell tool with no sandbox.
- Plaintext credential present
- A value matching a known key format, a database URL with a real-looking password, or a long random value in a variable named like a key, token or secret. Placeholders and environment references don’t count.
- No PreToolUse hook
- A Claude Code settings file with no PreToolUse hook. Hooks and rules can also live in user or local settings we can’t see.
Its limits.
- Public repositories only. A file someone commits is not the same as the file they run, and private setups may be stricter or looser.
- GitHub code search returns at most 1,000 results per query and indexes default branches, so we split queries by file size and still saw a fraction of what exists. Search order isn’t random, which biases the sample in ways we can’t measure.
- Up to 400 files per kind, so the kinds are weighted equally, not by how common they are. Only 126 other mcp.json files passed the path filter.
- Categories come from package and server names. A server named “db” that isn’t one, or a database server with an unusual name, is counted wrong.
- A config can’t show what a credential is allowed to reach. A writable database server may hold a read-only role, and a read-only flag may sit on a role that can write.
- We make the scanner used here, so weigh the grade numbers with that in mind. The scripts and the aggregate data are published below, so anyone can rerun the count on a fresh sample.
Check your own configDownload the aggregate CSV See the agent-database benchmark
Cite as: Deedglass, “State of AI agent permissions 2026”, deedglass.com/research/agent-permissions-2026, snapshot 2026-10-26. The scripts: collect, fetch, analyze, aggregate. The scanner: deedglass on GitHub.
Questions.
How many AI agent config files on GitHub give the agent database write access?
In our 26 October 2026 sample, 10.9% of the 1,702 public files that declare MCP servers (185) connect a database MCP server with no read-only setting.
How often do Claude Code projects use hooks to check tool calls?
74.4% of 399 public .claude/settings.json files have no PreToolUse hook, and 93.5% have no ask rule.
Did you publish or keep any of the secrets you found?
No. Each file was checked for credentials that look real and counted as “plaintext credential present”. No value, repo, path or person was recorded, and the fetched files were deleted after the counts were taken.
Can I check my own config?
Yes. Run npx deedglass scan in your project, or paste a config into the checker at deedglass.com/check. Both give the grade used in this report, on your machine.