---
id: agent-permissions-scan
track: coding
version: 0.2.2
label: blocks
keyword: block
where: write turn-end
sha256: e99236718000ebee6efee9ca05c12899eab612ca643ea07bdaa24b195a79d106
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/agent-permissions-scan
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Scan Agent Permission Settings

agent-permissions-scan · version 0.2.2

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Blocks: parses agent permission configs (.claude/settings*, .codex, .gemini, .vscode, .cursor/cli.json, opencode, .aider, .continue) and flags added bare or wildcard allows (Bash, curl/rm/sudo/git push, WebFetch, Write/Edit globs, mcp__*), removed deny entries, bypass/auto modes, codex never+danger, yolo, autoAccept, yes-always, regex-all VS Code approve, Claude project env API-endpoint overrides and enableAllProjectMcpServers. Misses: other MCP configs, user-level settings, scripts, Read.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=agent-permissions-scan
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=agent-permissions-scan
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=agent-permissions-scan
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=agent-permissions-scan
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=agent-permissions-scan
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=agent-permissions-scan
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=agent-permissions-scan
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=agent-permissions-scan
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=agent-permissions-scan
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=agent-permissions-scan
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=agent-permissions-scan

## What it misses

Other MCP configs, user-level settings, scripts, Read.

## Examples

- Refused: A settings file allows every tool with the star alone on its own line, the pretty-printed form the line-based sibling cannot see.
- Allowed: A scoped Bash prefix allow.

## Latest change

0.2.2 · 2026-10-27 — Title wording only (IR-F40): "Agent Permissions Scan" is now "Scan Agent Permission Settings". The id, guard and tests are unchanged.

## Provenance

- Tested by 54 of 54 cases run automatically
- SHA-256: `e99236718000ebee6efee9ca05c12899eab612ca643ea07bdaa24b195a79d106`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/agent-permissions-scan (catalog path `base/agent-permissions-scan`)
- Presets: Agent configuration
- JSON: `/api/coding/policies/agent-permissions-scan.json`
- Report a problem: https://chock.sh/report/?policy=agent-permissions-scan&version=0.2.2&page=%2Fcoding%2Fpolicies%2Fagent-permissions-scan%2F