DEV Community

konstantinos gkioulmpaxiotis
konstantinos gkioulmpaxiotis

Posted on Originally published at ntinosgkiou-code.github.io

What did your coding agent do last month?

#ai #security #opensource #python

Anthropic says users accept 93% of Claude Code's manual permission prompts. I wanted to know what was in the ones I clicked through, so I wrote a read-only scanner for my own history.

The idea

Claude Code already keeps a transcript of every session on your machine, in ~/.claude/projects. Each tool call the agent made is in there, with the command or the path, the folder it ran in, a timestamp, and whether it failed. Nothing needs to be installed in the agent and nothing needs to be sent anywhere: the information is already on disk.

python -m agentdryrun scan reads those files, names what the agent attempted, and judges each action against a rules file as a dry run: would it pass, would it need a human, or would it be refused. Nothing is blocked, changed or executed. Python 3.9+, no dependencies.

A sample report card: 48 actions judged, 24 would have passed, 19 would have needed approval, 5 would have been refused

A sample report card. Every command in it is invented.

What it names

  • recursive deletes, by how far from the project they reach (inside it, outside it, your home directory, a path it cannot resolve);
  • force pushes and remote branch deletes, with extra weight on main;
  • a download piped into a shell (curl ... | sh);
  • secret files read (.env, ssh keys, cloud credentials) and files or command output sent to another host;
  • destructive database and cloud commands, with a hint when the command mentions production;
  • writes to the agent's own settings, CI workflows, git hooks and shell startup files;
  • MCP tools whose names suggest they change, send or delete something.

The starter rules are a JSON file in the repository. Copy it and change it to how you work: a dry run is only as good as the rules it is judged by. scan --write-rules writes a copy that locks the kinds of action that do not appear in your own history.

What went wrong in the first version

I ran the first version on one real 90-day history, about 11,000 tool calls. It said roughly a fifth of everything needed approval and a couple dozen actions would be refused. Almost all of it was noise from my own parser:

  • curl ... | python -c "..." was flagged as "download piped into a shell". It only reads the download.
  • Text inside a here-document (a note, a script being written to a file) was read as if it were commands.
  • rm -rf "$DIR/build" was "a path built from a variable we cannot check", even when the variable was set on the line above.
  • Every cd other-folder && rm -rf build was judged against the wrong folder.
  • Any write outside the working directory counted, although people legitimately work in several directories.

After fixing those, about 3% needed approval and two actions were refused. Both were real force pushes to main. The lesson is not subtle: invented test fixtures would have shown none of this. The repository's tests now pin every one of these cases, and the build log records the mistakes.

What it cannot do

  • It matches patterns in commands. It misses a script that deletes files, python -c, and paths built at run time, and it flags a few harmless things.
  • It sees what the agent attempted. It cannot know whether a command worked, or whether you approved it.
  • Claude Code only, for now. The transcript format is not a documented interface and was read as it looked on 25 October 2026; a new version can break the reader.
  • It is not a sandbox and stops nothing. Auto mode, permission rules and sandboxes are the tools for that. This tells you what they would have had to catch.

Try it 

git clone https://github.com/ntinosgkiou-code/agentdryrun
cd agentdryrun
python -m agentdryrun scan --no-previews
Enter fullscreen mode Exit fullscreen mode

--no-previews leaves command text out of the page, so you can share it. Inside Claude Code: claude plugin marketplace add ntinosgkiou-code/agentdryrun, then claude plugin install agentdryrun@agentdryrun and /agentdryrun:scan.

The most useful thing you can send back is where it is wrong: a false alarm, something it missed, or a crash. Paste the command text only, no secrets, in an issue. If you use Codex or another agent and can share a redacted session file, issue 11 explains what would let it read yours too.

Code, tests and the full build log (including the mistakes) are in the repository. Prototype, Apache-2.0, no external security review.

Written with AI assistance (Claude); the code, the tests and the measurements are real.

Top comments (0)