Watch: check agent files
No sound. Each step is captioned on screen and also written out in the guide below.
AI Tools
Agent Security Scanner
Check the files that control an AI agent's behavior, not the text it reads: instructions (CLAUDE.md, AGENTS.md), settings and permissions, MCP server configs, and GitHub Actions workflows that run agents or bots.
Check files locally
Runs locally in your browser. Files are read on your device, not uploaded, saved, or shared.
Pick the file type above if it isn’t detected correctly, then press Check.
Add files to check them.
| File | Findings | Actions |
|---|
Check in three steps
- 01Add your files
CLAUDE.md, settings.json, a workflow, or an MCP config, one or several.
- 02Read what's flagged
Each finding says what it found and why it matters, by severity.
- 03Fix or share
Copy the report for your team, or go fix the file.
What it checks
- Instructions: injected-looking text, hidden characters, and instructions to skip confirmation or logging.
- Settings:
bypassPermissions, wildcard allow rules, and hooks that run dangerous commands. - Workflows:
pull_request_targetwith an untrusted checkout, scripts piped into a shell, and PR text injected into a command. - MCP configs: delegates to the MCP Config Builder & Checker's rules.
Findings are likely risks with reasons, not proof of safety.
Frequently asked questions
What's the difference from the Prompt Injection Scanner?
That scanner checks text an AI is about to read (a document, an email, a web page). This one checks the files that control what an agent is allowed to do: its instructions, permissions, hooks, and the CI workflows that might run it. It reuses the same detection engine for the instructions file check.
Why is "bypassPermissions" critical?
It turns off the confirmation prompt for every tool call, for the whole session. Combined with a tool that can run shell commands or write files, there's no longer a human check before the agent acts.
What's wrong with pull_request_target?
Nothing by itself. The risk is combining it with checking out the pull request's own branch: that trigger runs with your repository's secrets even for a pull request from a stranger, so if the workflow then runs that stranger's code, they get your secrets. GitHub calls this a "pwn request."
Does this prove a file is safe?
No. It's rule-based and can't see what a tool call does at runtime, or catch a risk it has no rule for. A clean result means nothing matched the rules it has, not that the file is safe.
Is my file uploaded?
No. Every check runs in your browser.