whats-inherited-mcp

You review the code you clone. Almost nobody reviews the part of it that talks to your agent. An MCP server that enumerates everything in a checkout addressed to an AI agent rather than to you: instruction files, hook commands wired to agent events, MCP servers the repo declares, and the skills and subagents it ships.

Why

git diff shows you code, and you read code. It also shows you three added lines in a CLAUDE.md, and you skim those, because they look like documentation. They are not documentation — they are instructions your model will follow.

The surface is bigger than most people picture. A directory you cloned can carry:

• CLAUDE.md / AGENTS.md / .cursorrules — loaded into context and treated as instructions, including nested copies deep in the tree that only apply when the agent works in that subdirectory
• hook commands in .claude/settings.json — shell wired to fire on tool use, session start, or prompt submit
• .mcp.json — MCP servers the repo asks to add, often launched with npx -y <package>, which means the code that runs is downloaded at start time and is not the code you reviewed
• .claude/skills, .claude/commands, .claude/agents — capabilities the repo hands the agent

Nothing collects that in one place. This does.

Run against a checkout of langfuse/langfuse at 7d2afa4 — an ordinary, reputable open-source repo, picked precisely because there is nothing wrong with it:

# Inherited agent surface

**12 item(s) in this checkout are addressed to an agent, not to you.**

| Surface                       | Count | Detail                                                       |
|-------------------------------|------:|--------------------------------------------------------------|
| Instruction files             |    12 | ~41,848 est. tokens, 5,593 lines your agent is told to follow |
| Hook commands                 |     0 | configured to run on agent events                             |
| MCP servers declared          |     0 | 0 fetch code from a registry at launch                        |
| Skills / commands / subagents | 33 extensions (196 files) | shipped under `.agents/`, available to the agent |

## Worth a look
- 11 instruction file(s) are **not at the repo root** — they apply when the agent
  works in those subdirectories and are easy to miss in review.

and instruction_files adds:

> Counted once, reachable under more than one name (symlinks):
> - `AGENTS.md` ← also `.agents/AGENTS.md`, `CLAUDE.md`

Five and a half thousand lines of standing instruction, most of it in files you would never open, in a repo nobody has any reason to distrust. That is the point: the number is large even in the benign case, which is exactly why an unusual entry in it goes unnoticed.

Tools

Every tool takes an optional dir. When it is omitted the server falls back to WI_DEFAULT_ROOT if that

... View full README on GitHub