Is the content I paste stored?

No. Workspace content is checked in memory only. It is not written to the database or logs, not sent to an external AI and never executed.

Can I scan from Claude Code or Cursor?

Yes. After connecting over MCP, call the scan_agent_workspace tool. It needs the separate workspace:scan permission.

Does a finding mean there is a vulnerability?

Not necessarily. Findings are risk signals to review. Ordinary lines such as "never commit .env" are not treated as attacks.

MCP and AGENTS.md security scan

AI agents follow the instruction files and MCP configs in your workspace. One hidden line can make an agent send your keys somewhere else. Budgethelm checks them line by line.

Files it understands

AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules (including .mdc), mcp.json, .mcp.json and claude_desktop_config.json (mcpServers or VS Code servers). Other file names are checked with the text rules. Up to 20 files and 65,536 characters per scan.

What it flags in instruction files

Reading or sending credentials: ~/.ssh, .aws/credentials, browser cookies, keychain, wallets and similar.
Sending or printing keys, .env files or environment variables; uploading with curl, wget, nc, scp and similar; curl | sh.
URLs commonly used to collect data, such as webhook.site, ngrok and Discord or Telegram webhooks.
base64, hex and similar obfuscation (decoded and checked again).
Requests to ignore previous instructions, hide actions from the user, override roles, skip permissions or disable the sandbox (in English and Chinese).
Instructions hidden in HTML comments, Markdown comments or display:none, and hidden Unicode such as zero-width and bidirectional control characters.

What it flags in MCP configs

Packages launched with npx, uvx and similar without an exact version (including latest, ^ and ~).
Installs from Git or URLs, remote servers over plain http, temporary tunnels or collection services.
Secrets hard-coded in env or headers, or placed in URLs.
Access to / or ~, to sensitive folders such as ~/.ssh, Docker --privileged or a mounted docker.sock.
Working directories in Downloads, mail attachments or temp folders.

Each finding has a risk level, file, line, reason, suggested fix and an evidence snippet with secrets masked.

Website security scan

You can also run passive checks on domains you are authorised to test: exposed front-end keys, publicly readable .env or config files, public Supabase or Firebase settings, and security headers. Only project owners can add domains, after confirming ownership or authorisation. Results are risk signals, not confirmed vulnerabilities.

FAQ

Is the content I paste stored?: No. Workspace content is checked in memory only. It is not written to the database or logs, not sent to an external AI and never executed.
Can I scan from Claude Code or Cursor?: Yes. After connecting over MCP, call the scan_agent_workspace tool. It needs the separate workspace:scan permission.
Does a finding mean there is a vulnerability?: Not necessarily. Findings are risk signals to review. Ordinary lines such as "never commit .env" are not treated as attacks.