The files that configure an AI agent inside a project: CLAUDE.md, AGENTS.md, skills, subagents and commands, .claude/settings.json, .mcp.json, Cursor, Copilot and Windsurf rules, and the VS Code, Gemini CLI and Codex configuration. Drop the project folder before opening it with your agent: it is read, nothing is run, and the files never leave your browser and are not saved.
Hooks, pre-approved MCP servers, commands inside skills, tasks that run when the folder opens… These are the pieces that act without you clicking anything, so they are listed first.
A fact is a specific configuration key (a hook, a permission, a URL): it is either there or not. A signal is a sentence in the instructions that looks like an attack. Signals raise many false alarms: in a study of 98,380 skills, out of every hundred flagged by the best pattern detector, at most one was actually malicious. They also miss things. That is why they are never a verdict, and a file without signals is not a safe file.
If the project declares MCP servers, the tool classifies them and says how many of the three legs they cover between them — private data, content you don't control, and a way to send data out. With all three at once, theft is possible; with two, it isn't. The Agents tool teaches the concept in more depth, along with the rest of the defenses.
It reads the configuration and runs nothing. It separates facts (a specific key: a hook, a permission, a URL) from signals (sentences that look like an attack). Signals are often wrong: a file with no findings is not a safe file.