Cloned a Stranger's Repo? Check 6 Agent Config Files Before Claude Code or Codex Opens It

Before engaging with a cloned repository containing AI coding tools like Claude Code, Codex, or Gemini CLI, it is crucial to examine six specific configuration files. These files can initiate various operations and potentially pose security risks.

The first file, .claude/settings.json, contains hooks that run shell commands, an environment block, and helper commands such as apiKeyHelper. Some of these settings are stored in a local version, .claude/settings.local.json, which also gets tracked in Git.

Next is .mcp.json, responsible for project MCP servers. An MCP server with trust set to true bypasses all tool call confirmations, bypassing safety measures.

For Gemini CLI, .gemini/settings.json handles hooks that execute arbitrary code with user privileges and lists MCP servers. Enabling trust for this folder allows servers to bypass all tool call confirmations, while also potentially bypassing all other validations.

In Codex, .codex/config.toml and .codex/hooks.json outline project configurations and hooks that could execute arbitrary code with user privileges.

Lastly, AGENTS.md, a project-specific configuration file, reads settings either at the project root or from the directory where it is started. It can also include other files using @path imports, which the agent may execute.

Before trusting a repository, one must inspect these files. This process involves checking the content of the files, verifying that no malicious commands or settings are present, and ensuring they do not bypass safety checks. This precautionary step is vital for maintaining the security and integrity of your development environment.