Audit your AI agents (CLI)

npx @vulnify/cli audit

Run it in a project folder. It checks the AI agents configured on your machine and in that project, and answers: what can each agent do here, and is that safe?

It’s local and read-only. It reads config files and never changes them. It doesn’t start MCP servers or make any network calls, and no file contents leave your machine. Secrets are always masked to their first 4 characters plus ***, including in --json.

Options

Option	What it does
--json	Machine-readable output: score, counts, files checked, findings
--fail-on <severity>	Exit 1 if any finding is at or above low, medium, high or critical. Use it in CI
--dir <path>	Check another project folder (default: the current folder)

Exit codes: 0 passed, 1 a finding hit --fail-on, 2 bad option.

What it reads

Tool	Files
Claude Code	~/.claude/settings.json, .claude/settings.json, .claude/settings.local.json, managed settings, ~/.claude.json (MCP servers), .mcp.json, CLAUDE.md, CLAUDE.local.md, ~/.claude/CLAUDE.md
Cursor	~/.cursor/mcp.json, .cursor/mcp.json, ~/.cursor/cli-config.json, .cursorrules, .cursor/rules/
Codex	~/.codex/config.toml, .codex/config.toml, ~/.codex/AGENTS.md, AGENTS.md
Claude Desktop	claude_desktop_config.json in ~/Library/Application Support/Claude (macOS), %APPDATA%\Claude (Windows) or ~/.config/Claude (Linux)
VS Code / Copilot	.vscode/mcp.json, user-profile mcp.json, ~/.copilot/mcp-config.json, .github/copilot-instructions.md

CLAUDE_CONFIG_DIR, CODEX_HOME and COPILOT_HOME are honored.

Rules

Rule	Severity
Approvals bypassed (bypassPermissions, Codex danger-full-access) or Bash(*) / wildcard allow rule	critical
Destructive command pre-approved: rm, curl | sh, git push --force, chmod, sudo	high
Plaintext secret in an MCP server’s env, headers, args or URL	high
Token (AWS, GitHub, OpenAI, Anthropic, Slack, Stripe, npm, private key…) in an agent config file	high
MCP server that exposes shell or command execution	high
Filesystem MCP server with access to / or your home folder	high
Prompt injection in instruction files: “ignore previous instructions”, “don’t tell the user”, sending secrets to a URL, known capture endpoints, invisible Unicode, hidden HTML comments	high
Remote HTTP MCP server with no auth	medium
No Claude Code deny rules for .env, ~/.ssh or ~/.aws	medium
.env file in the project	medium
Agent config containing secrets that other users can read (macOS and Linux)	medium
npx or uvx MCP server without a pinned version	low

Example

Vulnify audit  read-only, nothing left this machine
Checked 4 config files (Claude Code, Cursor, VS Code)

CRITICAL Approvals are bypassed or every command is allowed
  ./.claude/settings.json:1  allow rule "Bash(*)"
  Why: The agent runs any shell command and edits any file without asking, so one bad prompt is enough to do damage.
  Fix: Remove bypass mode / wildcard allow rules and allow only the specific commands you need.

HIGH     Plaintext secret in MCP server config
  ~/.cursor/mcp.json:3  server "github", GITHUB_PERSONAL_ACCESS_TOKEN = ghp_***
  Why: The key sits in a config file that gets synced, backed up, pasted into issues and read by other tools and agents.
  Fix: Move it to an env var or OS keychain and reference it, then rotate the key.

Score 60/100 (C)  1 critical, 1 high
Turn these into enforced policies: npx @vulnify/cli hook claude-code / vulnify.io

In CI

- run: npx -y @vulnify/cli@latest audit --fail-on high

From findings to enforcement

The audit tells you what an agent could do. To control what it does, install the Vulnify hook: every shell command, file write and MCP tool call gets ALLOW, REVIEW or BLOCK before it runs.