A coding agent that cannot edit a file sounds safe to point at an unfamiliar repository. Before the first edit, though, it may load settings from the repository, start a declared connector, or run a hook. Denying its Write tool does not settle who gets to start those processes.

This isn't a claim that every coding agent behaves the same way. It's a reason to test the exact command you plan to run, especially if that command will open code you did not write.

The permission you forgot to inspect

In an October DEV.to account, the author tested a scanner adapter against a hostile repository on Linux with Claude Code 2.1.288. The repository contained a .claude/settings.json hook and a .mcp.json server declaration. In the reported test, both ran under the adapter's original command even though Write remained denied. That's the author's result for that adapter and version, not an audit of other agents.

The reported fix didn't disable every tool.…