ThisCalculator

Everyday

Limit AI Coding Agent File & Terminal Access

Updated · Standard formula, shown below

Limit AI Coding Agent File & Terminal Access

This guide shows you how to restrict what an AI coding agent (like GitHub Copilot, Cursor, or a custom agent) can read, write, or execute on your machine. You’ll learn to scope its file access to specific directories and control or disable terminal commands, which prevents accidental or malicious damage to your system. You’ll need admin rights on your machine and access to the agent’s configuration files or its graphical settings.

What You’ll Need

  • Administrator or owner access to the machine where the agent runs.
  • Access to the AI coding agent’s configuration file (e.g., .cursorrules, .claude/settings.json, settings.json for VS Code, or a YAML/TOML config for custom agents).
  • If using a custom agent, the ability to edit its source code or environment variables.
  • For terminal restrictions: a clear idea of which commands are safe (like git status) and which are dangerous (like rm -rf or sudo).

Step-by-Step

  1. Identify the agent’s configuration location. For VS Code extensions like GitHub Copilot, open settings.json (Ctrl+Shift+P → “Preferences: Open User Settings (JSON)”). For Cursor, look for .cursorrules in your project root or the global ~/.cursor directory. For Claude Code or similar CLI tools, check for a .claude folder in your home directory or project. Write down the exact path.
  2. Define allowed file paths. In the configuration, add a setting that restricts the agent’s file access. For Copilot, set "github.copilot.advanced.debug.fileAccess": "allowed" and then list allowed directories under "github.copilot.advanced.debug.allowedPaths" (e.g., ["/home/user/projects/myapp"]). For Cursor, add a permissions section in .cursorrules with "allow": ["read", "write"] and "paths": ["./src", "./tests"]. For custom agents, use environment variables like AGENT_ALLOWED_DIRS or a config file that lists allowed roots.
  3. Block or limit terminal commands. Most agents have a setting to disable terminal execution entirely. In VS Code, set "github.copilot.advanced.terminal.enabled": false to turn off all terminal commands. If you need some commands, use a whitelist. For Cursor, add "terminal": {"enabled": true, "allowedCommands": ["git status", "npm test"]} in .cursorrules. For Claude Code, use the permissions object in settings.json to specify allow and deny rules for Bash commands.
  4. Set a working directory. Force the agent to operate only within a specific folder. In Cursor, set "workspace": "./myproject" in .cursorrules. For CLI tools, launch the agent from that directory or set AGENT_WORKDIR in the environment. This prevents it from reading files outside the project.
  5. Restrict network access (optional but recommended). Some agents can fetch packages or send data. In your firewall or proxy, block the agent’s process from making outbound connections except to trusted domains (like the package registry). For example, on Linux, use iptables to deny the agent’s user ID from accessing the internet except for specific IPs.
  6. Test the restrictions. After saving changes, restart the agent. Try to ask it to read a file outside the allowed paths (e.g., /etc/passwd) and run a command like rm -rf /tmp/test. It should refuse or return a permission error.
  7. Document the policy for your team. If you’re working in a team, create a SECURITY.md file in the repo explaining what the agent can and cannot do. This helps everyone stay consistent.

Common Mistakes

  • Using a blacklist instead of a whitelist. Blocking specific files or commands is fragile; the agent can find other ways. Always whitelist what’s allowed.
  • Forgetting to restart the agent. Many agents cache config changes. Always restart after editing.
  • Setting too broad a path. Allowing /home/user instead of /home/user/projects gives access to your entire home directory, including SSH keys and browser data.
  • Not testing with a real command. A config that looks correct may not actually be enforced. Always run a test.
  • Ignoring environment variables. Some agents read settings from environment variables that override config files. Check for those too.

Tips

  • Use a dedicated user account for the agent with minimal permissions (e.g., no sudo). This is the strongest protection.
  • For terminal access, prefer read-only commands like git diff and npm test over write commands like npm install or git push.
  • If your agent supports it, use a sandbox like Docker or a virtual machine to run the agent. This isolates it completely.
  • Review the agent’s logs regularly to see what it actually attempted. Most agents log denied actions.
  • Keep your agent updated—new versions often add security features.

Troubleshooting

  • The agent still reads files outside allowed paths. Check if the agent has a separate config for the IDE vs. the CLI. For example, Copilot in VS Code uses settings.json, but the CLI may use a different file. Also verify that the path format matches (use absolute paths, not relative).
  • Terminal commands still run. Some agents have a per-project override. Look for a .cursorrules or .claude/settings.json in the project root that might override your global settings. Also ensure that the setting name is correct—check the agent’s documentation for the exact key.
  • The agent crashes after config changes. This usually means the JSON is malformed. Validate your config with a JSON linter. Also, remove any comments if the format doesn’t support them.
  • Changes don’t take effect on a remote server. If the agent runs on a remote machine, you must edit the config on that machine, not your local one.
  • Whitelisted commands are still blocked. Check if the command requires a shell (like git status vs. git). Some agents block commands that include pipes or redirects. Try simplifying the command.

Frequently Asked Questions

  • Can I limit an AI agent to read-only file access? Yes. In most agents, you can set permissions to allow only read operations. For example, in Cursor, set "permissions": {"allow": ["read"]}. The agent will be able to view files but not edit them.
  • What if my agent doesn’t have a built-in permission system? You can wrap the agent in a sandbox. Use Docker with a read-only filesystem or a non-root user. Alternatively, use chroot on Linux to confine it to a directory.
  • Does limiting access affect the agent’s ability to help with code? It may, if the agent needs to read dependencies or configuration files outside your project. To mitigate, add those specific directories to the allowed paths (e.g., /usr/lib/node_modules for Node.js).
  • Can I set different limits for different projects? Yes. Use project-level config files like .cursorrules or .claude/settings.json in each repo. These override global settings.
  • Is it safe to give an agent access to my terminal at all? It’s risky, but you can reduce risk by whitelisting only safe commands and using a non-admin user. For high-risk tasks, consider running the agent in a container.
  • How do I revoke access if I suspect a breach? Immediately stop the agent process, remove its configuration or disable the extension, and change any API keys the agent might have used. Review your system for unauthorized changes.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.