# Agent Permission Graph

> See what your AI agent can reach: MCP servers, commands, files, network and secrets – with risks. Paste an agent or MCP client configuration (Claude Desktop, Claude Code, Cursor, Windsurf, Cline, VS Code mcp.json, Zed) plus optional allow/deny rules and file roots. The tool draws a graph agent → servers → capabilities (commands executed, filesystem paths, network endpoints, secrets by name only) and flags risks: plaintext secrets, tokens on the command line, whole-disk or home-directory access, credential folders, unpinned packages, privileged containers, remote servers without auth or TLS, and auto-approve settings. Secret values are never shown.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://agentpermissiongraph.usefulweb.site/ (interactive tool at https://agentpermissiongraph.usefulweb.site/tool)
- JSON API: POST https://agentpermissiongraph.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://agentpermissiongraph.usefulweb.site/api/v1/tool)
- OpenAPI: https://agentpermissiongraph.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://agentpermissiongraph.usefulweb.site/mcp - tool `agent_permission_graph`

## Inputs
- config (textarea, required): Agent / MCP client configuration (JSON or JSONC) - Secret values are masked and never returned. You can replace them with dummy values before pasting.
- allowTools (list): Allowed / auto-approved tool rules (optional) - One per line, e.g. mcp__github__create_issue, github.*, filesystem/*.
- denyTools (list): Denied tool rules (optional)
- roots (list): File roots exposed by the client (optional)

## Method
- Recognised shapes: mcpServers (Claude Desktop, Claude Code, Cursor, Windsurf, Cline), servers (VS Code mcp.json), mcp.servers (VS Code settings), context_servers (Zed). JSONC comments and trailing commas are accepted. Per server: command/args/env/cwd (stdio) or url/serverUrl/httpUrl/headers (remote), disabled, autoApprove/alwaysAllow, trust.
- Capabilities: the executed command (and the package/image for npx, uvx, pipx, bunx, docker), filesystem paths in arguments and docker volume mounts, URLs, and secrets – environment variables and headers whose NAME looks like a credential.
- Secrets are identified by name (KEY, TOKEN, SECRET, PASSWORD…) and by well-known token formats (sk-, ghp_, github_pat_, xox*, AKIA, glpat-, AIza, JWTs, private keys, URL credentials). Values are never output: they are replaced by ***. References like ${input:…}, ${env:…}, $VAR and placeholders do not count as plaintext.
- Findings: tokens in args (visible in the process list), plaintext secrets in config, wide roots (/, ~, $HOME, C:\, /Users…), credential folders (~/.ssh, ~/.aws…), shells, unpinned packages/images, privileged containers or docker.sock, remote servers over HTTP or without auth headers, and auto-approve rules (incl. allow rules such as mcp__server__*).
- The graph shows up to 60 nodes; extra capabilities per server are collapsed into a “+N more” node (full lists are in the result).