v1.4.0 — Copilot settings hooks and MCP credential check

Closes two coverage gaps left after the 2026-09-02 re-verification, then ships everything that sat in Unreleased: the seven false-positive corrections, plan 038 content hashes and verbatim fixtures, and #13 Windsurf Cascade hooks / skills. 103 checks, 532 tests. Still offline on check.

Install

npx @chimix/agentscan@latest
npx skills add SimaAlexandru99/agentscan

GitHub Action:

- uses: SimaAlexandru99/agentscan@v1
  with:
    fail-on: error

Skill: https://skills.sh/simaalexandru99/agentscan/agentscan

Added

• Copilot CLI inline hooks in .github/copilot/settings.json and .github/copilot/settings.local.json (always copilot-cli, source copilot-settings). User $COPILOT_HOME/settings.json or ~/.copilot/settings.json under --global. Same-event hooks from settings and .github/hooks coexist. $COPILOT_HOME is honored for user hook files too. .claude/settings.json stays on the Claude profile. Policy and plugin hook files stay unread.
• mcp.literal-credential (security, warning): secret-named string values under MCP headers, http_headers, or auth that are not interpolation. Field paths only; values never echoed. Grok {{var}}, Gemini %VAR%, and the existing ${VAR} / ${env:} / ${input:} forms are interpolation. Token-shaped literals still fire security.hardcoded-secret first.
• bun run spec:check hashes the prose of every source page in scripts/spec-surfaces.ts (35 unique URLs) and compares against scripts/spec-hashes.json. bun run spec:record rewrites the baseline after a human has re-read the page. Page text is never stored.
• Conformance fixtures carry the vendors' own examples verbatim, with a minimum fact count per fixture so a discovery regression cannot keep a fixture green.

Fixed

• commandcode.mcp.invalid-transport no longer fires on "type": "streamable-http" in a shared .mcp.json, or on sse in Command Code-only files.
• agent-skills.skill.invalid-name accepts lowercase letters from any script (résumé-builder).
• copilot.hook.command-without-command accepts the documented exec (+ args) form.
• copilot.hook.unknown-event accepts PascalCase spellings of Copilot-only events in version: 1 files: SessionEnd, PostToolUseFailure, ErrorOccurred, PermissionRequest.
• mcp.literal-env treats Gemini CLI's Windows %VAR_NAME% form as interpolation.
• commandcode.agent.invalid-permission-mode accepts inherit.

Changed

• Spec captures re-read on 2026-09-02; spec:check now also diffs Copilot PascalCase aliases and exits 1 when a source page's content hash has moved.

From #13 — true findings and Windsurf Cascade hooks / skills

• .agentscan-root stops walk-up. Fenced SKILL.md examples, unclosed YAML, invalid Windsurf rule YAML, node . / ".", and outbound skill-directory symlinks no longer produce false findings.
• Windsurf Cascade hooks: .windsurf/hooks.json and --global ~/.codeium/windsurf/hooks.json.
• Windsurf Cascade skills: .windsurf/skills and --global ~/.codeium/windsurf/skills.

v1.3.0 — Windsurf, Grok Build, Codex user MCP

Native Windsurf / Cascade coverage. Also ships 1.2.0 (Grok Build provider) and 1.2.1 (Codex user MCP under --global) — those trains were never published as their own npm versions. 99 checks, 457 tests. Still offline on check.

Install

npx @chimix/agentscan@latest
npx skills add SimaAlexandru99/agentscan

GitHub Action:

- uses: SimaAlexandru99/agentscan@v1
  with:
    fail-on: error

Skill: https://skills.sh/simaalexandru99/agentscan/agentscan

Native Windsurf / Cascade coverage against 2026-08-31 official docs.
99 checks, 457 tests.

Added

• Spec captures docs/spec/windsurf-rules.md, windsurf-agents-md.md,
  windsurf-mcp.md.
• Workspace rules: .devin/rules/*.md (preferred), .windsurf/rules/*.md
  (fallback), subdirectory-scoped trees, legacy .windsurfrules.
  .devin is a scan-root signal.
• Character budgets: windsurf.rule.too-large (12,000) and
  windsurf.rule.global-too-large (6,000). Never cursor.rule.too-large.
• windsurf.rule.missing-trigger on workspace .devin / .windsurf rules
  that omit frontmatter trigger. Not on .windsurfrules,
  global_rules.md, or AGENTS.md.
• Portable lowercase agents.md (same sourceProvider: unknown as
  AGENTS.md).
• --global Cascade MCP at ~/.codeium/windsurf/mcp_config.json
  (windsurf-json). Launch is command or serverUrl or url.
  windsurf.mcp.no-launch when none are set. Never
  claude.mcp.url-without-type.
• --global ~/.codeium/windsurf/memories/global_rules.md only. Other
  files in that memories directory stay unread.

Unread (intentional)

• Devin Local CLI MCP (no published path).
• Auto-generated memories other than global_rules.md.
• System / enterprise rule directories.
• Project MCP (none quoted).
• Marketplace, admin allowlists, OAuth stores.

Also in this npm version

1.2.1 — 2026-08-31

Codex user MCP under --global. 95 checks, 441 tests.

Added

• $CODEX_HOME/config.toml (default ~/.codex/config.toml) is opened only
  with --global. Same codex-toml shape as project .codex/config.toml.
• Same-name user and project servers both stay in the inventory. The
  published page does not quote a replace-entirely rule, so this scanner
  does not invent codexEffective.
• Spec recapture docs/spec/codex-mcp.md (user path, CODEX_HOME, unread
  system / managed / requirements / profiles / plugins / trust / auth.json).

Unread (intentional)

• System /etc/codex/config.toml, managed preferences, requirements.toml,
  profile files, plugin MCP, trust_level.
• User-file project_doc_* knobs.
• Claude global settings; Command Code projects/{slug}/mcp.json.

1.2.0 — 2026-08-31

Native Grok Build provider against 2026-08-31 official docs. 95 checks,
435 tests. Compatibility with Claude or Cursor is not schema identity.

Added

• Spec captures docs/spec/grok-mcp.md, grok-hooks.md, grok-skills.md,
  grok-rules.md, grok-agents.md.
• Profiles: grok-toml MCP, grok hook and skill schemas.
  inferHookSchemaProfile("grok") is "grok", not "claude".
• Project .grok/config.toml walk-up (cwd → scan boundary). User
  $GROK_HOME/config.toml or ~/.grok/config.toml under --global.
  Same-name project replaces user; closer project file wins.
  grok.mcp.no-launch when neither command nor url is set. Never
  claude.mcp.url-without-type on grok-toml.
• .grok/hooks/*.json and user hooks under --global. Fourteen events;
  handlers command / http. Copilot version: 1 remap is not applied.
• .grok/skills (and user skills under --global). Frontmatter required;
  name / description optional. Agent Skills directory-match and Claude
  listing-budget checks do not run.
• .grok/rules/*.md with no size cap. Agents.md and AGENT.md as Grok
  instruction files beside AGENTS.md.
• Conformance fixture tests/fixtures/conformance/grok-toml/.
• spec:check drifts Grok hook event names against the live hooks page.

Unread (intentional)

• Managed / requirements TOML, plugins, marketplaces, personas, LSP,
  sandbox.toml, pager.toml.
• [skills] paths (no quoted resolution base).
• .grok/agents/ (directory named, no filename pattern).
• Claude / Cursor / .mcp.json as Grok-consumed.
• .gitignore skip for instruction files.
• Credential files (auth.json, mcp_credentials.json).

v1.1.0 — Command Code and correctness pass

Native Command Code provider, then a correctness pass over every registered check against 2026-08-31 official docs. Includes 1.0.1. 87 checks, 420 tests. Still offline on check.

Install

npx @chimix/agentscan@latest
npx skills add SimaAlexandru99/agentscan

GitHub Action:

- uses: SimaAlexandru99/agentscan@v1
  with:
    fail-on: error

Skill: https://skills.sh/simaalexandru99/agentscan/agentscan

check against 2026-08-31 official docs. Includes 1.0.1. 87 checks, 420
tests.

Added

• Hook schema profiles: claude | vscode-native | copilot-cli |
  commandcode. .github/hooks with version: 1 is Copilot CLI.
• Claude hook schema: required type (not inferred from command/url);
  mcp_tool needs server + tool; prompt/agent need prompt;
  documented event/handler compatibility; nested matcher groups only.
• Copilot CLI: camelCase events mapped onto VS Code names; bash /
  powershell / command; cwd; timeoutSec then timeout. Prompt
  hooks only on sessionStart. User ~/.copilot/hooks under --global.
• Agent Skills optional constrained fields: compatibility 1..500,
  metadata map<string,string>, allowed-tools string. Info for
  SKILL.md >500 lines. File references resolve from the skill root only.
• Claude skill listing budget: 1% context window, 8000-character fallback,
  per-entry cap 1536, listing text is description (or first markdown
  paragraph) plus when_to_use. First paragraph satisfies missing
  description.
• OpenCode V2: local command must be an argv array
  (opencode.mcp.command-not-array).
• Continue standalone YAML blocks require name / version / schema
  (continue.mcp.missing-block-metadata). Copied JSON is not checked.
• Gemini underscore alias warning (gemini.mcp.underscore-alias).
• Claude reserved MCP names including workspace
  (claude.mcp.reserved-name).
• Codex chain knobs: AGENTS.override.md > AGENTS.md >
  project_doc_fallback_filenames; one file per directory; root→cwd;
  project_doc_max_bytes; project_root_markers.
• Coverage matrix uses five dimensions (project discovery, global
  discovery, schema, precedence, conformance) instead of full /
  partial.
• Conformance fixture tests/fixtures/conformance/copilot-hooks/.
• Spec capture docs/spec/copilot-hooks.md. Alias
  claude.hook.mcp-tool-without-name →
  claude.hook.mcp-tool-without-server-or-tool.

Changed

• Nested <dir>/.commandcode/AGENTS.md is Command Code memory when that
  directory has no AGENTS.md (official memory table).
• Native VS Code remains command-only with its documented eight events.
  vscode.hook.http-without-url and vscode.hook.mcp-tool-without-name
  are removed.
• Claude agent names: lowercase letters and hyphens (no digits); filename
  is not compared to name.
• skill.description-budget provenance is vendor-recommendation, not a
  16000-byte heuristic.

Added (Command Code provider)

• Provider commandcode from official pages under docs/spec/commandcode-*.md
  (read 2026-08-31). Unknown stays skip: no invented local-project MCP slug,
  no bundled-skill scan, no --skill flags, no model-id list, no mods
  execution.
• Skills: .commandcode/skills only at the Command Code project root
  (Agent Skills contract), .agents/skills walk-up (max 10 hops from cwd,
  stopping at home), extra dirs from the highest-precedence settings
  skills array (replace, not merge; relative paths resolve against the git
  root). User ~/.commandcode/skills and ~/.agents/skills under
  --global.
• Memory: per directory, first existing of AGENTS.md or
  .commandcode/AGENTS.md (project and nested). User
  ~/.commandcode/AGENTS.md under --global. Unresolved @path is not a
  hard error. Codex's instruction chain excludes .commandcode/AGENTS.md.
• Agents: <project>/.commandcode/agents/*.md at the Command Code project
  root only (git root, or cwd outside a git repo); filename supplies
  name; no claude.agent.* on these files. Checks:
  commandcode.agent.reserved-name (explore / plan / review /
  general), invalid-permission-mode, invalid-field-type covering every
  documented custom-agent typed field (reasoningEffort is not one of them).
  maxTurns must be a positive integer.
• Hooks: four events (PreToolUse, PostToolUse, Stop, SessionStart);
  nested hooks array required; type must be the string "command";
  command must be a string (not an argv array); matcher must be a string
  when present. Timeout 0–600. A matcher on Stop / SessionStart is
  runtime-dead, not a schema error. Project and user hooks for the same event
  coexist; only an exact duplicate command string is deduplicated (project
  wins). settings.local.json follows settings merge (an event array
  replaces the project array for that event). COMMANDCODE_PROJECT_DIR and
  COMMANDCODE_CWD expand against the Command Code project root.
• Settings: Command Code project root is the git root (a child .cursor
  does not hide <git-root>/.commandcode/). model inventoried, not
  validated. Inline mcp.servers (array or object map; unnamed array items
  are inventory-only). User ~/.commandcode/mcp.json under --global.
  Spec/runtime checks skip shadowed lower-precedence definitions; security
  checks still inspect every readable MCP file.
• Slash commands: inventory .commandcode/commands at the project root and
  the user dir — no required-field checks.
• Mods: inventory mods.paths — never execute or import TypeScript.
• Conformance fixture tests/fixtures/conformance/commandcode/.
• spec:check tracks captured surfaces and diffs Claude, VS Code, Copilot
  CLI, and Command Code hook events against live pages.

Also changed

• Default skillPaths includes .commandcode/skills.
• --global / includeGlobal also scans ~/.commandcode/skills,
  ~/.agents/skills, user Command Code agents, MCP, memory, Copilot user
  hooks, and Codex global AGENTS files.
• Shared .mcp.json is mcp-json, not Claude-only.

1.0.1 (shared .mcp.json is mcp-json, not Claude-only) ships inside this package version; see CHANGELOG.md.

v1.0.0 — first stable release

First stable release. 59 checks, 345 tests. Offline on check. The coverage matrix in the README is the honesty contract: full only where discovery, spec-required fields, and a conformance fixture (or equivalent tests) all exist.

Install

npx @chimix/agentscan@latest
npx skills add SimaAlexandru99/agentscan

GitHub Action:

- uses: SimaAlexandru99/agentscan@v1
  with:
    fail-on: error

Skill: https://skills.sh/simaalexandru99/agentscan/agentscan

Added

• Portable Agent Skills required fields (name, description, directory match) for .agents/skills, nested Cursor .cursor/skills, and .codex/skills.
• Path-keyed MCP parsers: VS Code servers, Cursor, Antigravity serverUrl, Codex TOML, Gemini command / url / httpUrl, OpenCode V1 and V2, Continue config.yaml plus .continue/mcpServers/*.
• Nested / walk-up AGENTS.md with nearest-wins; Codex instruction budget uses the effective per-directory file and project_doc_max_bytes.
• Walk-up .claude/agents; VS Code .github/agents without Claude missing-name errors.
• VS Code .github/hooks/*.json (eight events) and per-provider hook event sets.
• Cursor .cursor/rules/**/*.mdc 500-line recommendation (cursor.rule.too-large, info). Claude rules are inventoried only.
• Official-shaped fixtures under tests/fixtures/conformance/.
• spec:check tracks 21 captured surfaces, not only Claude hook events.
• Launch cwd and windows / linux / osx overrides on hooks and MCP.
• GitHub Action pin @v1.

Changed

• Product copy describes what 1.0.0 actually implements. Heuristics stay at info and are labeled in the registry.
• --global also scans ~/.codex/skills under the Agent Skills contract.
• In a monorepo, each skills-lock.json governs only the skills under its directory (nearest lock wins).

Fixed

• Nested SKILL.md trees are one skill, not a missing-md folder.
• Codex instruction chain: at most one file per directory; honour project_doc_max_bytes.
• Interpreter argv (node script.js), MCP command arrays, and OS overrides are path-checked. -- inline code (node -e) is not a path.
• JSONC (comments and trailing commas) parses via jsonc-parser; the published bundle imports the ESM entry so Node can load dist/cli.js.
• Scan boundary stays at Git/workspace. A child .cursor does not hide parent Claude or Codex.
• uses: is a launch only on Continue. Other profiles treat a uses-only entry as non-launchable.
• OpenCode V2 requires type plus the matching launch field. V1 enabled-only overrides that inherit externally do not emit a hard error.
• Windows drive / UNC cwd values and OS-specific script paths (scripts\format.ps1) are not joined as POSIX relative paths when the scanner runs on Linux or macOS.
• Old 0.7 rule ids still work in ignoreRules and explain.

0.9.0 was planned as a separate train and shipped inside this release.

v0.4.0 — colour, a face, and Node support

Colour, a face, and a report that reads at a glance.

  ┌─────┐   40/100  broken  ·  touchagency
  │ ✕ ✕ │   ██████████░░░░░░░░░░░░░░░
  │  ⌒  │   6 warn · 4 info hidden
  └─────┘

Since v0.1.0

Runs on Node. npx @chimix/agentscan@latest works without Bun
installed. The published bin is one bundled file, 4 files and 92 kB in
the tarball, no install-time dependencies.

Bare invocation scans. No subcommand means check the current
directory, so the quick start shows findings instead of a usage screen.

Repeated findings group. Six dead hooks printed the same sentence
six times; now one header with ×6 and one line per occurrence. Paths
are shown relative to the scanned project.

A score you can read. 40/100 broken — the word comes from the same
thresholds as the face and the colour, so they cannot disagree.

Colour on a terminal, never anywhere else. Piped output is
byte-identical to the uncoloured report, --json and --output prompt
are never coloured, and --copy puts plain text on the clipboard.
--no-color and NO_COLOR are honoured.

The YAML rule engine is gone. 709 lines producing 9 info findings
across 21 projects, with an extension point nobody had used. Its five
rules are code now, with byte-identical output.

Install

npx @chimix/agentscan@latest        # in any project
bun add -d @chimix/agentscan        # then: agentscan check

Scoped because npm rejects the bare name as too close to an unrelated
agent-scan. The command stays agentscan.

Still alpha

23 checks, each written against a published spec line recorded in
docs/spec/ with its source URL and date. 195 tests. No network on the
check path; nothing is written to the tree being scanned.

v0.1.0 — first alpha

First alpha. A deterministic, offline CLI that finds broken agent
configuration — hooks whose scripts are gone, MCP servers that can never
start, credentials pasted into config, skills that disagree with their
lockfile.

What it does

bunx agentscan check                 # text report
bunx agentscan check --output prompt # paste-ready handoff for a fixing agent
bunx agentscan check --fail-on error # CI gate

23 checks, each one written against a published spec line recorded in
docs/spec/ with its source URL and the date it was read — not against
what happens to appear in real projects. That distinction is the whole
point of this release: an earlier build reported 37 findings across 17
projects of which 25 were false, because two checks were written
from observation. Both were deleted.

Score

score = max(0, 100 - 10 × errors - 3 × warnings)

Published deliberately. Measured across 21 projects it spans 40–100, and
it does not penalise a project for being large: an 85-skill project with
one warning scores 97, while a 54-skill one with six dead hooks scores
40. Coverage-ratio scoring was built, measured, and rejected for
inverting exactly that.

Requires Bun

Bun 1.1+. Not a Node build — import.meta.dir and Bun.which are used
directly. check never touches the network and never writes to the tree
being scanned; the only subprocess in the tool is the optional --copy
clipboard write.

Known limits

• Alpha. The finding-id format is a contract but the check set will move.
• Published as @chimix/agentscan — npm rejects the bare agentscan as
  too close to an unrelated agent-scan. The command stays agentscan.