---
title: "AI agent configuration"
description: "Audits committed AI-agent configuration: hidden Unicode and hidden instructions in AGENTS.md and Cursor/Copilot/Windsurf/Cline/Gemini rule files, unpinned or plaintext MCP servers and inlined credentials in MCP configs, and over-broad Claude Code, Gemini CLI and Codex permission settings."
url: https://openaudit.se/auditors/code.agent-config/
---

# AI agent configuration

`code.agent-config`

Audits committed AI-agent configuration: hidden Unicode and hidden instructions in AGENTS.md and Cursor/Copilot/Windsurf/Cline/Gemini rule files, unpinned or plaintext MCP servers and inlined credentials in MCP configs, and over-broad Claude Code, Gemini CLI and Codex permission settings.

- **Engine:** Built-in
- **Targets:** Codebase
- **Areas:** Security, Supply chain
- **Runs:** By default, when the target applies
- **Network:** Only the target itself

## Run only this auditor

```sh
bunx @openaudit/cli . --only code.agent-config
```

Built into openaudit; nothing to install.

## More security auditors

- [Secrets in source](https://openaudit.se/auditors/code.secrets/) (`code.secrets`)
- [Static security analysis](https://openaudit.se/auditors/code.security/) (`code.security`)
- [Hidden Unicode](https://openaudit.se/auditors/code.unicode/) (`code.unicode`)
- [API definition and server configuration](https://openaudit.se/auditors/code.api/) (`code.api`)
- [gitleaks secret scan](https://openaudit.se/auditors/code.gitleaks/) (`code.gitleaks`)
- [Semgrep SAST](https://openaudit.se/auditors/code.semgrep/) (`code.semgrep`)
- [Trivy filesystem scan](https://openaudit.se/auditors/code.trivy-fs/) (`code.trivy-fs`)
- [trufflehog secret scan](https://openaudit.se/auditors/code.trufflehog/) (`code.trufflehog`)