# Fix: shell, network and file-write with no approval

Cut tool permissions to what the agent needs and require approval for risky calls.

Check: tool and permission scope. Controls: ASI02, MCP02.

## What is flagged

- Shell, network and file-write all allowed with no approval.
- Wildcard OAuth scopes.
- MCP tools with destructive verbs: `delete`, `drop`, `send`, `transfer`, `exec`.

## Claude Code

Edit `~/.claude/settings.json`. Deny the risky patterns and ask for the rest:

```json
{
  "permissions": {
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(curl:*)",
      "Bash(wget:*)",
      "Read(./.env)",
      "Read(~/.ssh/**)"
    ],
    "ask": ["Bash(git push:*)", "Bash(npm publish:*)"]
  }
}
```

## Codex

```bash
codex --ask-for-approval on-request --sandbox workspace-write
```

## Cursor

Turn off auto-run for terminal commands in Cursor Settings. Keep the command allowlist short.

## OAuth and API scopes

List the scopes each token has. Replace `*` and `admin` with the exact scopes used. Create one token per task.

## MCP servers

Read each server's tool list. Remove or disable tools you do not use. Disabled tools cannot be abused.

## Verify

```bash
npx -y securemyagent checkup
```

Pro: Guard asks the owner before destructive shell commands, money movement, outbound messages and writes outside the workspace.

## Sources

- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications/)
- [OWASP MCP Top 10](https://owasp.org/projects/mcp-top-10)
- [Cycode on the OWASP MCP Top 10](https://cycode.com/blog/owasp-mcp-top-10/)