Check C20 · agent surface family · severity CRITICAL · automatic · one of the 22 checks
The question this check asks: does a checked-in MCP or agent settings file — .mcp.json, .cursor/mcp.json, the files under .claude/ — define a command that fetches something from the network and runs it?
This class executes before the trust prompt. In CVE-2025-59536 (CVSS 8.7) Claude Code ran project code from .claude/settings.json and .mcp.json before the user had accepted the dialog asking whether to trust the folder; it was fixed in 1.0.111. In CVE-2025-64109 (CVSS 8.8) the Cursor CLI auto-executed the commands in .cursor/mcp.json with no confirmation at all. An MCP server definition is, by design, a command your agent's launcher will run as you; a definition whose command reaches out to a URL and executes the reply is curl | sh with an agent's name on it. The vetting standard's fix is to patch — Claude Code 2.0.65 or later, Copilot CLI 1.0.43 or later, current Cursor — and to disable project-scoped MCP autoload; this check is the part you can do before the download.
C20 fetches each configuration file, parses the JSON, and reads the command lines it defines — command plus args, joined. A line fires when it both fetches (curl, wget, Invoke-WebRequest and its aliases) and executes what it fetched: a pipe into a shell, an inline bash -c "curl … && ./x", or PowerShell's iex. The finding is CRITICAL, costs 30 points — a repository that trips nothing else scores 70 and reads amber — and quotes the offending line: “MCP/agent config launches a shell fetch — pre-trust execution class (CVE-2025-59536 / CVE-2025-64109): bash -c "curl -s https://… | sh"”. The verdict is BLOCK-grade; the default personal policy sets this check to warn, so the download is held and the line is shown, and the strict organisation profile blocks. The evidence note in the scoring table:
“pre-trust execution class; 1 legit npx -y FP on top-100 keeps it under an instant red”
Unparseable JSON yields nothing, deliberately: a launcher would not read it either, and guessing with a pattern over raw text is exactly what the next section is about.
Two, and we would rather list them than have you find them. The first shaped the weight: in the Phase 0 controls one of the 80 most popular repositories ships an MCP configuration that legitimately starts its server with npx -y, so a bare npx no longer fires. The second reshaped the rule. On 2 September 2026 an earlier version of this check — which matched a command key anywhere in the file and the word bash anywhere else — scored React 30 points down, because .claude/settings.json in react/react holds seventeen entries like Bash(yarn test:*): an allowlist of what an agent may run, read as a list of executions. Our own repository's settings file fired it too. The check now parses the document and reads only command lines, and a configuration whose command genuinely fetches and runs — some bootstrap scripts do — will still fire, and should: the finding shows you the line.
It sees the launch line, not the server. A plain npx some-package runs code from a registry too — the package is the payload in that case — and does not fire, because nothing in the line fetches a URL. What the launched server does once running is invisible here. Configuration outside the repository, and configuration under a filename we do not read, are not seen. Nor is a fetch-and-run that lives in an agent instruction file's prose rather than a command field; the standard's advice to read those files before starting an agent is not replaced by this or any check.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. It reads the configuration before the download; it does not see the agent launch the server.
Without installing anything: open .mcp.json and .cursor/mcp.json on GitHub and read every command and args as a shell line. With the GitHub CLI and jq:
gh api repos/OWNER/REPO/contents/.mcp.json --jq .content | base64 -d | jq -r '.mcpServers | to_entries[] | "\(.key): \(.value.command) \(.value.args // [] | join(" "))"'Then, per the standard: patch your agent to a version that asks before running project configuration, and disable project-scoped MCP autoload until you trust the folder. Any line containing curl, bash -c, iex or npx -y deserves a second read before that.
Does an MCP config that runs npx fire this check? Not on its own. Launching a package with npx is how most legitimate MCP servers start, and one of the 80 most popular repositories in our controls does exactly that with npx -y. The check fires when a single command line both fetches from the network — curl, wget, Invoke-WebRequest — and executes what it fetched: a pipe into a shell, an inline bash -c that fetches and runs, or PowerShell's iex. The finding shows you the exact line.
Why did this check once block React? An earlier version matched keywords across the whole file, so a command key on one line and the word bash on another fired together. React's own .claude/settings.json holds seventeen entries like Bash(yarn test:*) — an allowlist of what may run, read as executions — and scored 30 points off, measured on 2 September 2026. The check now parses the JSON and reads only the command lines. We mention it because a false positive on the most popular repository on GitHub is the kind of thing a vendor should say out loud.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads — Download ZIP and release-asset archives. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. It reads the configuration before the download; it does not see the agent launch the server.
C18 Agent config files — the files this check parses · C21 Credential redirect — the same files pointing an API base URL or key somewhere else (CVE-2026-21852) · C10 Devcontainer auto-execution — pre-trust execution one layer down.
Add RepoGates to Chrome Pricing
Numbers on this page: CVE-2025-59536 and CVE-2025-64109 as published; Phase 0 controls of 2026-08-14 (one npx -y configuration among 80 popular repositories); the react/react measurement of 2026-09-02 recorded in the engine's source; weights and actions from the product's scoring and policy tables.