Best Way to Audit What Permissions Your AI Tools Actually Have

[DarkLantern]

Following the Miasma supply chain attack that targeted AI coding tools through their configuration systems, a lot of people are realising they are not certain what their AI assistants can actually access.

How do you check what permissions Claude Code, Copilot, Cursor, Gemini CLI or any other AI coding tool has been granted? Where do these tools store their config files? What should you be looking for? Specific, actionable responses preferred.

[PlanetOftheApes]

On Mac, Claude Code stores its config in ~/.claude/. The settings.json file in that directory is what the Miasma attack targeted. Check that file for unexpected hooks in the SessionStart or other event fields