What Watch checks
AI agents and MCP
New in 1.2.0 Requires Cloak Watch 1.2.0 or later.
How Cloak Watch checks MCP servers, agent settings, hooks, skills and Dev Containers, including project files a cloned repository brings, and what each finding means.
AI agents and editors run commands, start MCP servers and read rules files on their own, often as soon as you open a folder. Cloak Watch reads the configs of Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex, Gemini CLI, Kiro, Zed and others, without starting any server or agent, and flags the settings attacks use: malicious servers, hooks that run hidden scripts, approval prompts turned off, and project files a repository you didn’t write brings with it.
Your own configs
Section titled “Your own configs”These checks cover your user-level settings and every project:
| Card | Tier | What it means |
|---|---|---|
| MCP-1 | Act now | An MCP server runs from a hidden or temporary folder, a file inside node_modules, or an inline shell script, or an incident pack names it |
| MCP-2 | Act now | An MCP server launches a package version on the feed |
| MCP-7 | Review | A remote MCP server is on a tunnel or throwaway host, or a bare IP address, or its host changed since Watch first saw it |
| MCP-8 | Review | Cursor older than 1.3, Claude Code older than 1.0.111 or 2.1.196, or Codex CLI older than 0.131.0: releases from before fixes for a project’s config running before you trusted the folder |
| AGT-1 | Act now or Review | Claude Code hooks that run hidden scripts, downloads or eval |
| AGT-3 | Review | An AI tool’s traffic sent somewhere other than its provider |
| AGT-9 | FYI | Tool approval turned off in your own settings (“… runs commands without asking”) |
| AGT-11 | Review | An AI tool at a release an incident says was tampered with |
| SKL-1, SKL-2 | Act now, Review | A skill on the feed or on Datadog’s malicious-skill list, or a SKILL.md that downloads and runs something |
The full list, including AGT-2 to AGT-8 and MCP-3 and MCP-5, is in the detection catalogue.
Project files from a repository you don’t own
Section titled “Project files from a repository you don’t own”A cloned repository can bring its own .mcp.json, agent settings or Dev Container config, and an agent or editor may act on them the moment you open the folder. Watch treats these as more serious when the repository isn’t yours.
“A repository you don’t own” is a clone whose remote isn’t you: not your GitHub login (from gh or github.user), not an owner of any repository you’ve committed to or pushed from on this Mac, and with no commits or pushes from this Mac in that repository. Folders with no Git remote are never treated as someone else’s.
| Card | Tier | What it means |
|---|---|---|
| MCP-6 “A cloned repo brings its own MCP server” | Review; Act now when the server runs from a hidden or temporary folder, node_modules or an inline shell script |
A project MCP server in .mcp.json, .cursor/mcp.json, .vscode/mcp.json, .codex/config.toml, .gemini/settings.json, .kiro/settings/mcp.json or opencode.json |
| AGT-9 “A cloned repo turns off …’s approval prompts” | Review | The repository’s shared settings turn tool approval off: Claude Code permissions.defaultMode: "bypassPermissions", Codex approval_policy = "never" with sandbox_mode = "danger-full-access", VS Code-family chat.tools.global.autoApprove, or a catch-all terminal auto-approve rule |
| AGT-10 “A repo changes the environment of …’s commands” | Review; Act now when PATH reaches a folder in the repository with its own git, node or python |
A project’s Claude Code or Codex settings set PATH, BASH_ENV, NODE_OPTIONS, PYTHONPATH, DYLD_* or similar |
| DEV-1 “A cloned repo’s dev container runs a command on your Mac” | Review; Act now when it downloads, decodes or pipes into a shell | A Dev Container initializeCommand, which runs on the Mac, not in the container |
AGT-10 applies to any project, owned or not. Specific allow rules, such as "npm test": true, aren’t a no-approval mode and aren’t flagged.
Fix it
Section titled “Fix it”Watch never edits agent settings. Each card names the exact file and key to remove. For a project you don’t trust, the safest fix is not to open it in an agent or editor until you’ve read its config.
For a skill on a list, Fix it moves the skill’s folder to Quarantine. When the SKILL.md shares its folder with other things (a skills folder, a repository’s root or an agent’s config folder), Watch moves only SKILL.md, which turns the skill off, and asks you to check the rest by hand.
See what agents do
Section titled “See what agents do”Checks look at configs. To see what your agents actually send and run, and to block risky tool calls, use AI Activity and its Guard rules.