I have six AI agents installed on one laptop: Claude Code, Cursor, Codex, OpenCode, OpenClaw and DeepSeek Harness. Between them they run 14 MCP servers.
I wrote a read-only scanner to answer a question none of them could answer on their own: what can all of my agents touch, together?
It finished in 0.19 seconds. This is what came back.
Finding 1: 12 of the 14 MCP servers are unpinned
context7 -> npx @upstash/context7-mcp (unpinned)
playwright -> npx @playwright/mcp@latest (@latest)
github -> npx @modelcontextprotocol/server-github (unpinned)
... 12 in total
Every npx -y <package> is a supply-chain decision. @latest means the code that runs at startup is whatever was published to npm most recently — not the version you tested. My GitHub MCP server holds a personal access token and pulls @latest on every start.
This is not theoretical. 2025 already had real malicious MCP packages on npm harvesting .env files.
Finding 2: five API keys sit in plaintext in agent config files
| Location | What |
|---|---|
~/.dsh/mcp-manager.json |
GitHub token x2 |
~/.codex/config.toml |
OpenAI key |
~/.cursor/mcp.json |
GitHub token |
~/.config/opencode/opencode.json |
OpenAI key |
The scanner masks values and never prints them. But the values are there, in plaintext, on disk.
Any process — or any agent — that can read those files has my GitHub and OpenAI accounts. This is close to the default configuration on most developer machines right now.
Finding 3: six agents, no inventory
Cursor knows its own permissions. OpenClaw knows its own. Nothing answers "what can all of my agents do together?" That is the shadow-agent problem, and it is why the scan report matters more than any single finding in it.
What I changed
-
Pin versions.
npx -y pkg@1.2.3, never@latest. - Move secrets to a keychain. Tokens out of agent config files and into a system keychain or secret manager.
- Put a gate in front of tool calls. A policy layer that denies sensitive paths, blocks secret output, and hash-chains every call for audit.
Run the scan yourself
Read-only, offline, nothing uploaded, secrets masked in the report:
curl -fsSL https://gitee.com/suhuisoftwares/pod/raw/v0.3.2/scripts/install.sh | sh
pod scan
Apache-2.0. Local-first.
Repo: https://gitee.com/suhuisoftwares/pod (mirror: https://github.com/suhui-organization/pod)
Site: https://podsec.vercel.app
The numbers come from a real scan of the author's machine (first scan 2026-09-01, re-confirmed 2026-09-12). No key values are published — run pod scan to get your own.
Top comments (0)