Search every repo for files that AI coding tools read: CLAUDE.md, AGENTS.md, .mcp.json and .cursor/rules. Teams commit these on purpose so everyone gets the same behavior, which makes them a reliable signal of which agents and MCP servers a team uses, and what instructions those agents follow.
Why config files are good discovery signals
Most discovery methods look at traffic or devices. This one looks at the repo, and developers help you by committing the files. The documentation of these tools says so directly.
- Claude Code's MCP documentation says project-scoped servers are stored in a .mcp.json file at the project root and that you should check it into version control so everyone gets the same tools. Its memory documentation says project instructions live in CLAUDE.md or .claude/CLAUDE.md.
- AGENTS.md describes itself as a README for agents. It sits at the repository root, and in monorepos subprojects can have their own.
- Cursor's documentation says project rules live in .cursor/rules as .mdc files and are version controlled.
A committed file is a statement: this team has adopted this tool.
The search
git ls-files | grep -E '(^|/)(CLAUDE\.md|AGENTS\.md|\.mcp\.json)$|(^|/)\.cursor/rules/'
git grep -nE '"(command|url)"' -- '*.mcp.json'
The second line pulls out what each MCP server runs or connects to. Run both across all repos, then build a table:
| Repo | Config file | What it tells you | Follow up |
|---|---|---|---|
| (repo) | .mcp.json | MCP servers declared, with command or URL | Is each server approved? |
| (repo) | AGENTS.md or CLAUDE.md | Instructions given to agents | Do they contradict policy? |
| (repo) | .cursor/rules | Rules for a specific editor agent | Which tool is in use? |
What to read inside them
For MCP configuration, check each server entry. A local command that runs a package fetched at launch is a dependency, and a remote URL is a third party with access to whatever the agent sends. Claude Code's documentation notes that it prompts for approval in interactive sessions before using project-scoped servers from .mcp.json, which is a useful safeguard but not a substitute for a review of what is declared.
For instruction files, read for anything that tells an agent to bypass checks, disable tests, or fetch things from the internet. Instructions are text, so treat changes to them as code changes and route them through review. See codeowners protect workflow files for the same idea applied to CI.
Feed the results into your approved list
Each server and tool you find needs a decision. See inventory of MCP servers: enterprise program and AI coding assistant allowlist: what to approve. Where a team's file names a tool you have not approved, start with a conversation, not a block.
Limits
User-level settings live on developer machines and in home directories, not in repos, so this search finds team-wide adoption and misses private experiments. It is a floor, not a ceiling.
Quick check
Should we ban committed MCP config?
No. Committed config is easier to review than one that lives on laptops. Require review and an approved list instead.
Do all AI tools leave files in the repo?
No. Many keep settings per user. Combine this search with the dependency and hostname searches in how to find which AI services our code calls.
Safeguard offers an MCP Guardrail, agent identity, asset discovery and a free scan at gold.safeguard.sh/scan.
Sources
- Claude Code docs: Connect Claude Code to tools via MCP
- Claude Code docs: How Claude remembers your project
- AGENTS.md
- Cursor docs: Rules
Last reviewed: 19 October 2026.
