agentscan

![CI](https://github.com/kriskimmerle/agentscan/actions/workflows/test.yml/badge.svg)
![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)
![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)

# agentscan

**AI Agent Security Posture Scanner** — enumerate all AI coding agents on a machine and map their aggregate permission surface.

Developers run 3-5 AI agents simultaneously. Nobody audits the aggregate. Each agent has different config files, MCP servers, shell access, filesystem scope, and credential exposure. `agentscan` maps them all in one command.

## What It Scans

| Agent | Config Locations | What It Checks |
|-------|-----------------|----------------|
| **Claude Desktop** | `~/Library/Application Support/Cursor/` | MCP servers, secrets in config |
| **Claude Code** | `~/.cursor/`, `~/.cursor.json`, project `.cursor/` | Permissions, allowed tools, dangerous flags, MCP |
| **Cursor** | `~/.cursor/`, `~/Library/.../Cursor/` | MCP servers, `.cursorrules` secrets |
| **VS Code** | `~/Library/.../Code/User/` | Cursor, Cline, Continue, Roo Code, MCP |
| **Windsurf** | `~/Library/.../Windsurf/`, `~/.codeium/` | MCP servers, settings |
| **Zed** | `~/.config/zed/` | API keys in config, assistant settings |
| **Codex CLI** | `~/.codex/` | Approval mode, instruction secrets |
| **aider** | `~/.aider.*` | Config secrets, .env files |
| **Moltbot/OpenClaw** | `~/clawd/`, `~/.config/moltbot/` | AGENTS.md, sudo usage, running processes |

## What It Finds

### Per-Agent
- 🔑 **Hardcoded secrets** (API keys, tokens, passwords in config files)
- 🛡️ **MCP server risks** (shell execution, dangerous commands, unvetted packages, filesystem scope)
- ⚡ **Dangerous permissions** (permanently allowed tools, `--dangerously-skip-permissions`, full-auto mode)
- 📂 **Filesystem exposure** (system directory access, sensitive path mounts)
- 🔓 **Credential exposure** (sensitive environment variables passed to MCP servers)

### Cross-Agent
- 📊 **Agent dens