Audit your AI agent's configuration before the agent runs it.

cfgaudit is a static security auditor for the files that configure coding agents: Claude Code settings, hooks, skills and plugins, MCP servers, CLAUDE.md and AGENTS.md, and the configs of Cursor, Codex, Copilot, Gemini CLI and more. It catches unrestricted permissions, hooks that run on every session, unpinned MCP servers, leaked secrets and prompt injection in instruction files. It runs offline as a single binary and never starts an agent.

Install Browse the rules

116rules 4/10OWASP LLM risks 8/10OWASP MCP risks 0network calls

$ cfgaudit .
.claude/settings.json [error] CFG001: permissions.allow contains "Bash(*)"
.claude/settings.json [error] CFG003: enableAllProjectMcpServers: true auto-approves every MCP server in any .mcp.json …
.claude/settings.json [warn] CFG004: defaultMode: "bypassPermissions" in a repository-controlled settings file is …
.claude/settings.json [warn] CFG006: permissions.deny is absent or empty
.claude/settings.json [warn] CFG009: hooks.PostToolUse command interpolates $CLAUDE_FILE_PATHS
.mcp.json [warn] CFG010: mcpServers.browser: argument "@playwright/mcp@latest" uses unpinned :latest/@latest tag
CLAUDE.md:5:1 [error] CFG029: CLAUDE.md line 5 instructs the agent to bypass permission prompts ("Never ask for …
.claude/settings.json [warn] CFG040: permissions.allow grants unrestricted WebFetch ("WebFetch")
.mcp.json [error] CFG049: mcpServers.docs connects to "http://docs.example.com/mcp"
.claude/settings.json [warn] CFG067: project-scoped settings define hooks (PostToolUse)

cfgaudit 1.18.1 — 10 findings

Every finding names the rule, the file and what to do instead. Each rule has a page with the risk, what is flagged and a safe alternative, for example CFG004 and CFG036. The example above is the sample repository scanned by cfgaudit 1.18.1.

Supported agents

cfgaudit is built around Claude Code and reads the configuration of other coding agents too. Each row links to what cfgaudit checks for that agent in the README of cfgaudit 1.18.1.

Agent	What cfgaudit reads
Claude Code	Settings with permissions, env and hooks, MCP servers, `CLAUDE.md`, skills, commands, subagents and plugins
VS Code workspace	`.vscode/`
Cursor & GitHub Copilot	hooks, permissions and repository settings
Gemini CLI	`.gemini/settings.json` & `GEMINI.md`
OpenAI Codex CLI	`.codex/config.toml` & `AGENTS.md`
Continue	`.continue/config.yaml` & `.continue/settings.json`
Devin CLI	`.devin/` and everything it imports
Devin Desktop (formerly Windsurf)	`.devin/`, with `.windsurf/` as the fallback
OpenCode	`opencode.json` and its siblings
xAI Grok CLI	`.grok/`
qwen-code	`.qwen/` & `QWEN.md`
Kimi Code	`.kimi-code/` & `.agents/agents/`

The instruction files of further agents are read as well, among them AGENTS.md, Cline's .clinerules, Zed's .rules and Amp's AGENT.md; the README lists every path.

Install

GitHub Action

- uses: cfgaudit/cfgaudit@v1.18.1
  with:
    path: .

Runs the published container image. With format: sarif the findings go to GitHub Code Scanning.

GitLab CI/CD component

include:
  - component: gitlab.com/cfgaudit/cfgaudit/cfgaudit@v1.18.1

A second component reports findings in the merge request's Code Quality widget.

Homebrew, Go or Docker

brew install cfgaudit/tap/cfgaudit
go install github.com/cfgaudit/cfgaudit/cmd/cfgaudit@v1.18.1
docker run --rm -v "$PWD:/work" -w /work \
  ghcr.io/cfgaudit/cfgaudit:1.18.1 .

The container image is signed with cosign and carries SLSA provenance.

Binary

curl -sSLO \
  https://github.com/cfgaudit/cfgaudit/releases/download/v1.18.1/cfgaudit_1.18.1_linux_amd64.tar.gz
tar xzf cfgaudit_1.18.1_linux_amd64.tar.gz

Archives for Linux, macOS and Windows on amd64 and arm64 on the release page, with checksums.txt and SLSA provenance. Check a download with gh attestation verify as shown in Verifying a release.

Claude Code plugin

/plugin marketplace add cfgaudit/cfgaudit
/plugin install cfgaudit@cfgaudit

Adds /cfgaudit:scan, /cfgaudit:explain <RULE> and /cfgaudit:init, and hooks that scan after edits to settings.json, CLAUDE.md, .mcp.json or .claude/ and when a session ends. Without a cfgaudit on your PATH it downloads the checksum-verified release binary. Team rollout in the README.

Output formats: text, table, JSON, SARIF and Code Climate, with an example of each. See the README for every option and every agent cfgaudit reads, and Verifying a release to check a download before you run it.