What PoisonZero watches
PoisonZero watches a fixed set of agent memory and configuration files on each device, locally. This page lists the exact path patterns under protection.
Overview
Three groups of files are watched:
- Instruction and rule files - always protected inside a detected project, cannot be switched off.
- Agent configuration files - watched inside already confirmed agent projects.
- Config and hook files - classified by path and routed to the config check.
Instruction and rule files (always on)
The known agent instruction and rule files. Protected inside every detected project root, recursively (** matches any depth), and never switchable off:
| Pattern | What it is |
|---|---|
**/CLAUDE.md | Claude Code project instructions |
**/AGENTS.md | Agent instructions (Codex, OpenClaw) |
**/GEMINI.md | Gemini CLI instructions |
**/.cursorrules | Cursor rules |
**/.clinerules | Cline rules |
**/.windsurfrules | Windsurf rules |
claude.md is the same file the agent loads as CLAUDE.md, so it is matched too.Agent configuration files
These configure what the agent is and what it may reach - which tool servers exist and what the workspace hands it. Watched inside already confirmed agent projects:
| Pattern | What it is |
|---|---|
**/.mcp.json | MCP tool-server configuration |
**/mcp.json | MCP tool-server configuration |
**/.vscode/tasks.json | VS Code tasks (only under .vscode/) |
tasks.json sits in countless ordinary dev projects, so it is not a trigger on its own.Config and hook files
Agent config and hook files, classified by their path and routed to the config check:
| Pattern | What it is |
|---|---|
**/settings.json | Agent settings |
**/settings.local.json | Local agent settings |
**/setup.mjs | Agent setup hook |
The config route also includes the three agent-configuration files above (.mcp.json, mcp.json, .vscode/tasks.json).
Per-agent memory locations
The built-in registry ships default watch locations per agent, relative to the user home; the memory globs are relative to each agent root:
| Agent | Home path | Memory globs |
|---|---|---|
| Claude Code | .claude | **/memory/**, settings.json, settings.local.json, setup.mjs |
| OpenClaw | .openclaw | **/AGENTS.md, **/*.memory.md |
| OpenClaw Skills | .openclaw/skills | **/*.md |
| Agent Skills | .agents/skills | **/*.md |
| Cursor | .cursor | rules/** |
| Windsurf / Codeium | .codeium | **/memories/** |
| Cline | .cline | **/*.md |
| Continue | .continue | **/rules/** |
| OpenAI Codex | .codex | **/AGENTS.md |
| Gemini CLI | .gemini | **/GEMINI.md, settings.json |
Optional: all Markdown
- Off by default.
- The
ProtectAllMarkdowntoggle additionally covers every**/*.mdfile under a protected root.
node_modules are skipped when the watcher sets up recursively - one source of truth, no duplicate copy.Read next
Once you know what is watched, see how a change is judged and reverted: PoisonZero is fail-closed and guards against memory poisoning.
Protect the files your agent reads on every run.
Free for Linux, macOS and Windows. Install once, updates run automatically.
Sign me up