The latest articles on DEV Community by Praneeth Kumar (@praneeth54). https://dev.to/praneeth54 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4060157%2Ff9f8c0d4-f1a4-4c9b-bafe-e8c47729581e.png https://dev.to/praneeth54 en Praneeth Kumar Mon, 03 Aug 2026 08:28:24 +0000 https://dev.to/praneeth54/your-ai-coding-agent-might-be-making-your-repository-less-secure-i-built-a-tool-to-check-eig https://dev.to/praneeth54/your-ai-coding-agent-might-be-making-your-repository-less-secure-i-built-a-tool-to-check-eig <h1> Your AI Coding Agent Might Be Making Your Repository Less Secure (I Built a Tool to Check) </h1> <p>Over the last few months, AI coding agents like <strong>Cursor</strong>, <strong>Claude Code</strong>, and <strong>Codex</strong> have become part of many developers' daily workflow.</p> <p>They're incredible at generating code, fixing bugs, and accelerating development.</p> <p>But while everyone talks about what AI can build...</p> <p>Almost nobody talks about <strong>who audits the AI agent configuration itself.</strong></p> <p>That got me thinking.</p> <p>What happens when:</p> <ul> <li>MCP servers have overly broad permissions?</li> <li>Sensitive files like <code>.env</code> are accidentally exposed?</li> <li>Multiple instruction files start conflicting with each other?</li> <li>AI agents receive inconsistent project guidance?</li> <li>Security-sensitive configuration quietly drifts over time?</li> </ul> <p>We lint our code.</p> <p>We scan dependencies.</p> <p>We audit infrastructure.</p> <p><strong>Why aren't we auditing AI coding agent setups?</strong></p> <p>That question eventually led me to build <strong>AgentDoctor</strong>.</p> <h1> What is AgentDoctor? </h1> <p>AgentDoctor is an open-source CLI that audits AI coding agent configuration inside your repository.</p> <p>Instead of using AI to judge your project, AgentDoctor performs <strong>deterministic static analysis</strong>, making it predictable, explainable, and suitable for CI.</p> <p>It currently understands:</p> <ul> <li>Cursor</li> <li>Claude Code</li> <li>Codex</li> <li>MCP configuration</li> <li>Repository instruction files</li> <li>Security configuration</li> <li>Repository readiness scoring</li> </ul> <p>Everything runs locally.</p> <p>No API key.</p> <p>No cloud upload.</p> <p>No LLM required.</p> <h1> Why deterministic? </h1> <p>One thing I wanted from the beginning was predictable output.</p> <p>If the same repository is scanned twice, the result should be identical.</p> <p>That's why AgentDoctor doesn't ask another AI model to "review" your repository.</p> <p>Instead it evaluates explicit rules.</p> <p>That makes it reliable enough for automation and CI pipelines.</p> <h1> Example </h1> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>npx @praneeth_54/agentdoctor scan </code></pre> </div> <p>Example output:</p> <p>(Add your screenshot here)</p> <h1> Current Features </h1> <p>✅ Detects Cursor, Claude Code &amp; Codex</p> <p>✅ Repository readiness scoring</p> <p>✅ Security rule checks</p> <p>✅ MCP validation</p> <p>✅ AI instruction validation</p> <p>✅ JSON reports for CI</p> <p>✅ GitHub Action support</p> <p>✅ Deterministic static analysis</p> <h1> Why I Open-Sourced It </h1> <p>I believe AI coding tools will become part of every software project.</p> <p>As that happens, repositories will need tooling that checks AI-specific configuration just like we already check code quality.</p> <p>Making AgentDoctor open source allows developers to inspect how detections work, contribute new rules, and help shape the project.</p> <h1> What's Next? </h1> <p>I'm currently working on:</p> <ul> <li>More repository rules</li> <li>Better framework detection</li> <li>More AI agent support</li> <li>VS Code extension</li> <li>Automatic fixes</li> <li>Improved scoring</li> <li>Additional security checks</li> </ul> <h1> I'd Love Your Feedback </h1> <p>This project is still in beta, and I'm actively improving it.</p> <p>If you use Cursor, Claude Code, Codex, or any other AI coding assistant, I'd love to hear:</p> <ul> <li>What repository problems have you experienced?</li> <li>What checks should AgentDoctor add next?</li> <li>What would make a tool like this useful in your workflow?</li> </ul> <p>⭐ GitHub:<br> <a href="https://github.com/pranee54/AgentDoctor" rel="noopener noreferrer">https://github.com/pranee54/AgentDoctor</a></p> <p>📦 npm:<br> <a href="https://www.npmjs.com/package/@praneeth_54/agentdoctor" rel="noopener noreferrer">https://www.npmjs.com/package/@praneeth_54/agentdoctor</a></p> <p>Thanks for reading! If you find the project interesting, feedback and contributions are always welcome.</p> typescript opensource ai security