Workspace instruction and MCP configuration access
A tool call explicitly refers to CLAUDE.md or .mcp.json.
Why it is risky
Section titled “Why it is risky”Project instructions and server definitions can influence later agent behavior. An unauthorized edit may plant instructions or integrations that future sessions trust.
Example
Section titled “Example”An agent edits project instructions to ask future sessions to upload configuration files before starting work.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches recognized path references to CLAUDE.md and .mcp.json. Reads and writes can both match.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SUPPLY_CHAIN_WORKSPACE_CONFIG_ACCESS | supply_chain | Community | MEDIUM |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Check whether the call read or changed the file. Review actual changes for new instructions, external destinations, and unexpected server definitions.
False positives
Section titled “False positives”Reading project instructions at the start of a task and maintaining legitimate configuration are common authorized activities.
False negatives
Section titled “False negatives”Automatic startup loading without a visible tool call, unlisted instruction files, unsupported path fields, and changes before capture starts can be missed.
Technical details
Section titled “Technical details”A path access finding cannot establish prompt injection. The relevant evidence is the file content and how it influences the session.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.