Do you actually know what Claude has access to on your machine?

Do you actually know what Claude has access to on your machine?

I didn't. Not fully. I'd been clicking "yes" to tool approvals — filesystem reads, bash commands, API calls — without a complete picture of what was accumulating across tokens, MCP servers, and OAuth integrations.

So I built a /security-audit skill for Claude Code. On demand, it:

- Validates every API token live (LinkedIn, GitHub PAT, HuggingFace, Splunk, Webex) - Audits the filesystem MCP root — lists every repo Claude can read or write - Checks Claude Code's permission rules (allow/deny) for overly broad grants - Scans for .env files, private keys, and credentials sitting in the accessible path - Assesses blast radius: if something went wrong, what could actually be touched?

The first run surfaced some real stuff. Live credentials for Proxmox, Cloudflare, and GitLab in repos Claude had full read/write access to. A GitHub token registered under a different variable name than what env.sh exported. An old curl command permanently auto-approved in settings.local.json from a debugging session I'd forgotten about.

None of it was catastrophic. But it was exactly the kind of drift that builds quietly when you're moving fast on an MVP.

The skill writes a dated audit report to the repo. Reproducible, reviewable, commitable.

https://lnkd.in/ghpD4Hkg

If you're running Claude Code with MCP servers and local file access, you should know what you've said yes to.

#ClaudeCode #AITools #Homelab #SecurityMindset