DEV Community

Cover image for Your AI Coding Agent Might Be Making Your Repository Less Secure (I Built a Tool to Check)
Praneeth Kumar
Praneeth Kumar

Posted on

Your AI Coding Agent Might Be Making Your Repository Less Secure (I Built a Tool to Check)

#opensource #ai #security #typescript

Your AI Coding Agent Might Be Making Your Repository Less Secure (I Built a Tool to Check)

Over the last few months, AI coding agents like Cursor, Claude Code, and Codex have become part of many developers' daily workflow.

They're incredible at generating code, fixing bugs, and accelerating development.

But while everyone talks about what AI can build...

Almost nobody talks about who audits the AI agent configuration itself.

That got me thinking.

What happens when:

  • MCP servers have overly broad permissions?
  • Sensitive files like .env are accidentally exposed?
  • Multiple instruction files start conflicting with each other?
  • AI agents receive inconsistent project guidance?
  • Security-sensitive configuration quietly drifts over time?

We lint our code.

We scan dependencies.

We audit infrastructure.

Why aren't we auditing AI coding agent setups?

That question eventually led me to build AgentDoctor.

What is AgentDoctor?

AgentDoctor is an open-source CLI that audits AI coding agent configuration inside your repository.

Instead of using AI to judge your project, AgentDoctor performs deterministic static analysis, making it predictable, explainable, and suitable for CI.

It currently understands:

  • Cursor
  • Claude Code
  • Codex
  • MCP configuration
  • Repository instruction files
  • Security configuration
  • Repository readiness scoring

Everything runs locally.

No API key.

No cloud upload.

No LLM required.

Why deterministic?

One thing I wanted from the beginning was predictable output.

If the same repository is scanned twice, the result should be identical.

That's why AgentDoctor doesn't ask another AI model to "review" your repository.

Instead it evaluates explicit rules.

That makes it reliable enough for automation and CI pipelines.

Example 

npx @praneeth_54/agentdoctor scan
Enter fullscreen mode Exit fullscreen mode

Example output:

(Add your screenshot here)

Current Features

✅ Detects Cursor, Claude Code & Codex

✅ Repository readiness scoring

✅ Security rule checks

✅ MCP validation

✅ AI instruction validation

✅ JSON reports for CI

✅ GitHub Action support

✅ Deterministic static analysis

Why I Open-Sourced It

I believe AI coding tools will become part of every software project.

As that happens, repositories will need tooling that checks AI-specific configuration just like we already check code quality.

Making AgentDoctor open source allows developers to inspect how detections work, contribute new rules, and help shape the project.

What's Next?

I'm currently working on:

  • More repository rules
  • Better framework detection
  • More AI agent support
  • VS Code extension
  • Automatic fixes
  • Improved scoring
  • Additional security checks

I'd Love Your Feedback

This project is still in beta, and I'm actively improving it.

If you use Cursor, Claude Code, Codex, or any other AI coding assistant, I'd love to hear:

  • What repository problems have you experienced?
  • What checks should AgentDoctor add next?
  • What would make a tool like this useful in your workflow?

⭐ GitHub:
https://github.com/pranee54/AgentDoctor

📦 npm:
https://www.npmjs.com/package/@praneeth_54/agentdoctor

Thanks for reading! If you find the project interesting, feedback and contributions are always welcome.

Top comments (0)