# Project configuration that runs code

Flags repositories whose configuration executes code when an AI agent opens them — a
`core.fsmonitor` in `.git/config`, a hook or a `PATH` override in the project's
`.claude/settings.json`, an MCP server that starts from `.mcp.json`, a VS Code task that runs
on folder open. **Reported, not blocked.**

## Why this matters

In 2026 several coding-agent escapes worked the same way: the agent, or a file an attacker
got into the repository, wrote configuration that a trusted tool — git, the editor, the agent
itself — then ran. Opening the project was enough.

## What Sentilai does, and what it does not

The Endpoint Suite checks the projects your developers' agents have opened, on its regular
cycle. That means a finding appears **after** the project was opened, not before: this is
detection, not prevention. What you get is a record of which repositories carry this kind of
configuration and exactly which setting it was — before anyone can clean it up — and the
Gateway still governs whatever that code then tries to send.

## What is read

Only these files in each project: `.git/config` and the names of executable git hooks,
`.claude/settings.json` and `settings.local.json`, `.mcp.json`, `.cursor/mcp.json`,
`.codex/config.toml` and `.vscode/tasks.json`. Never your source code, never file contents
beyond the setting itself, never environment values — an `env.PATH` override is reported as
"env.PATH set", not by its value.

## Where you see it

On the device in **Diagnostics**, with the setting and the file it came from. Warning and
critical findings also become events in your SIEM export (`project_trust.detected`, and
`project_trust.resolved` when a later check no longer finds the setting).