What did your coding agent do last month?

konstantinos gkioulmpaxiotis — Mon, 26 Oct 2026 13:32:01 +0000

Anthropic says users accept 93% of Claude Code's manual permission prompts. I wanted to know what was in the ones I clicked through, so I wrote a read-only scanner for my own history.

The idea

Claude Code already keeps a transcript of every session on your machine, in ~/.claude/projects. Each tool call the agent made is in there, with the command or the path, the folder it ran in, a timestamp, and whether it failed. Nothing needs to be installed in the agent and nothing needs to be sent anywhere: the information is already on disk.

python -m agentdryrun scan reads those files, names what the agent attempted, and judges each action against a rules file as a dry run: would it pass, would it need a human, or would it be refused. Nothing is blocked, changed or executed. Python 3.9+, no dependencies.

A sample report card. Every command in it is invented.

What it names

recursive deletes, by how far from the project they reach (inside it, outside it, your home directory, a path it cannot resolve);
force pushes and remote branch deletes, with extra weight on main;
a download piped into a shell (curl ... | sh);
secret files read (.env, ssh keys, cloud credentials) and files or command output sent to another host;
destructive database and cloud commands, with a hint when the command mentions production;
writes to the agent's own settings, CI workflows, git hooks and shell startup files;
MCP tools whose names suggest they change, send or delete something.

The starter rules are a JSON file in the repository. Copy it and change it to how you work: a dry run is only as good as the rules it is judged by. scan --write-rules writes a copy that locks the kinds of action that do not appear in your own history.

What went wrong in the first version

I ran the first version on one real 90-day history, about 11,000 tool calls. It said roughly a fifth of everything needed approval and a couple dozen actions would be refused. Almost all of it was noise from my own parser:

curl ... | python -c "..." was flagged as "download piped into a shell". It only reads the download.
Text inside a here-document (a note, a script being written to a file) was read as if it were commands.
rm -rf "$DIR/build" was "a path built from a variable we cannot check", even when the variable was set on the line above.
Every cd other-folder && rm -rf build was judged against the wrong folder.
Any write outside the working directory counted, although people legitimately work in several directories.

After fixing those, about 3% needed approval and two actions were refused. Both were real force pushes to main. The lesson is not subtle: invented test fixtures would have shown none of this. The repository's tests now pin every one of these cases, and the build log records the mistakes.

What it cannot do

It matches patterns in commands. It misses a script that deletes files, python -c, and paths built at run time, and it flags a few harmless things.
It sees what the agent attempted. It cannot know whether a command worked, or whether you approved it.
Claude Code only, for now. The transcript format is not a documented interface and was read as it looked on 25 October 2026; a new version can break the reader.
It is not a sandbox and stops nothing. Auto mode, permission rules and sandboxes are the tools for that. This tells you what they would have had to catch.

Try it

git clone https://github.com/ntinosgkiou-code/agentdryrun
cd agentdryrun
python -m agentdryrun scan --no-previews

--no-previews leaves command text out of the page, so you can share it. Inside Claude Code: claude plugin marketplace add ntinosgkiou-code/agentdryrun, then claude plugin install agentdryrun@agentdryrun and /agentdryrun:scan.

The most useful thing you can send back is where it is wrong: a false alarm, something it missed, or a crash. Paste the command text only, no secrets, in an issue. If you use Codex or another agent and can share a redacted session file, issue 11 explains what would let it read yours too.

Code, tests and the full build log (including the mistakes) are in the repository. Prototype, Apache-2.0, no external security review.