AI coding agents make good security reviewers. They can read a repo the way a human reviewer would. But a security review means running an agent on code you do not trust, and that raises a question I had not thought about until I tested it: whose configuration does the agent obey, yours or the repo's?

I work on secfoo , an open-source (MIT) CLI that hands an agent such as Claude Code a security brief and a target. While verifying its Claude adapter, I tested exactly that.

The test

I built a small hostile repo with three things in it:

a .claude/settings.json with a hook that runs a command

a .mcp.json that defines an MCP server

settings that enable project MCP servers and try to allow Write , Edit and Bash

Then I ran the adapter's original command against it.

What happened with the old command

The repo's hook ran.

The repo's own MCP server started.

Write stayed denied, so the read-only grant held.

So the scanned code could make the scanner execute something, even though it could not write files.…