# AI agents and MCP

> How Cloak Watch checks MCP servers, agent settings, hooks, skills and Dev Containers, including project files a cloned repository brings, and what each finding means.

Source: https://docs.subcloak.com/cloak-watch/ai-agents-and-mcp/

Added in Cloak Watch 1.2.0.

AI agents and editors run commands, start MCP servers and read rules files on their own, often as soon as you open a folder. Cloak Watch reads the configs of Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex, Gemini CLI, Kiro, Zed and others, without starting any server or agent, and flags the settings attacks use: malicious servers, hooks that run hidden scripts, approval prompts turned off, and project files a repository you didn't write brings with it.

## Your own configs

These checks cover your user-level settings and every project:

| Card | Tier | What it means |
|---|---|---|
| [MCP-1](https://docs.subcloak.com/cloak-watch/detections/#mcp-1) | Act now | An MCP server runs from a hidden or temporary folder, a file inside `node_modules`, or an inline shell script, or an incident pack names it |
| [MCP-2](https://docs.subcloak.com/cloak-watch/detections/#mcp-2) | Act now | An MCP server launches a package version on the feed |
| [MCP-7](https://docs.subcloak.com/cloak-watch/detections/#mcp-7) | Review | A remote MCP server is on a tunnel or throwaway host, or a bare IP address, or its host changed since Watch first saw it |
| [MCP-8](https://docs.subcloak.com/cloak-watch/detections/#mcp-8) | Review | Cursor older than 1.3, Claude Code older than 1.0.111 or 2.1.196, or Codex CLI older than 0.131.0: releases from before fixes for a project's config running before you trusted the folder |
| [AGT-1](https://docs.subcloak.com/cloak-watch/detections/#agt-1) | Act now or Review | Claude Code hooks that run hidden scripts, downloads or `eval` |
| [AGT-3](https://docs.subcloak.com/cloak-watch/detections/#agt-3) | Review | An AI tool's traffic sent somewhere other than its provider |
| [AGT-9](https://docs.subcloak.com/cloak-watch/detections/#agt-9) | FYI | Tool approval turned off in your own settings ("… runs commands without asking") |
| [AGT-11](https://docs.subcloak.com/cloak-watch/detections/#agt-11) | Review | An AI tool at a release an incident says was tampered with |
| [SKL-1](https://docs.subcloak.com/cloak-watch/detections/#skl-1), [SKL-2](https://docs.subcloak.com/cloak-watch/detections/#skl-2) | Act now, Review | A skill on the feed or on Datadog's malicious-skill list, or a `SKILL.md` that downloads and runs something |

The full list, including AGT-2 to AGT-8 and MCP-3 and MCP-5, is in the [detection catalogue](https://docs.subcloak.com/cloak-watch/detections/#ai-agents-agt).

## Project files from a repository you don't own

A cloned repository can bring its own `.mcp.json`, agent settings or Dev Container config, and an agent or editor may act on them the moment you open the folder. Watch treats these as more serious when the repository isn't yours.

"A repository you don't own" is a clone whose remote isn't you: not your GitHub login (from `gh` or `github.user`), not an owner of any repository you've committed to or pushed from on this Mac, and with no commits or pushes from this Mac in that repository. Folders with no Git remote are never treated as someone else's.

| Card | Tier | What it means |
|---|---|---|
| [MCP-6](https://docs.subcloak.com/cloak-watch/detections/#mcp-6) "A cloned repo brings its own MCP server" | Review; **Act now** when the server runs from a hidden or temporary folder, `node_modules` or an inline shell script | A project MCP server in `.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, `.codex/config.toml`, `.gemini/settings.json`, `.kiro/settings/mcp.json` or `opencode.json` |
| [AGT-9](https://docs.subcloak.com/cloak-watch/detections/#agt-9) "A cloned repo turns off …'s approval prompts" | Review | The repository's shared settings turn tool approval off: Claude Code `permissions.defaultMode: "bypassPermissions"`, Codex `approval_policy = "never"` with `sandbox_mode = "danger-full-access"`, VS Code-family `chat.tools.global.autoApprove`, or a catch-all terminal auto-approve rule |
| [AGT-10](https://docs.subcloak.com/cloak-watch/detections/#agt-10) "A repo changes the environment of …'s commands" | Review; **Act now** when `PATH` reaches a folder in the repository with its own `git`, `node` or `python` | A project's Claude Code or Codex settings set `PATH`, `BASH_ENV`, `NODE_OPTIONS`, `PYTHONPATH`, `DYLD_*` or similar |
| [DEV-1](https://docs.subcloak.com/cloak-watch/detections/#dev-1) "A cloned repo's dev container runs a command on your Mac" | Review; **Act now** when it downloads, decodes or pipes into a shell | A Dev Container `initializeCommand`, which runs on the Mac, not in the container |

AGT-10 applies to any project, owned or not. Specific allow rules, such as `"npm test": true`, aren't a no-approval mode and aren't flagged.

## Fix it

Watch never edits agent settings. Each card names the exact file and key to remove. For a project you don't trust, the safest fix is not to open it in an agent or editor until you've read its config.

For a skill on a list, **Fix it** moves the skill's folder to [Quarantine](https://docs.subcloak.com/cloak-watch/quarantine/). When the `SKILL.md` shares its folder with other things (a skills folder, a repository's root or an agent's config folder), Watch moves only `SKILL.md`, which turns the skill off, and asks you to check the rest by hand.

> **Caution:**
> Agents run project hooks and MCP servers with your access to code and keys. Review a repository's `.mcp.json`, `.claude/settings.json`, `.codex/config.toml` and `.devcontainer` before you trust the folder in your agent.

## See what agents do

Checks look at configs. To see what your agents actually send and run, and to block risky tool calls, use [AI Activity](https://docs.subcloak.com/cloak-watch/ai-activity/) and its [Guard rules](https://docs.subcloak.com/cloak-watch/ai-activity/guard/).

## Related

  - [Inventory](https://docs.subcloak.com/cloak-watch/inventory/#ai-tools--mcp): The AI tools & MCP and Skills tabs.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/#ai-agents-agt): Every AGT, MCP, SKL and DEV check.
  - [Extensions](https://docs.subcloak.com/cloak-watch/extensions/): Editor and browser extensions.