What the poison0 agent watches
The poison0 agent watches a fixed set of agent memory and configuration files on each device, locally. This page lists the exact path patterns under protection.
Overview
Three groups of files are watched:
- Instruction and rule files - always protected inside a detected project, cannot be switched off.
- Agent configuration files - watched inside already confirmed agent projects.
- Config and hook files - classified by path; from model size Mini up a dedicated Melira expert evaluates them, with Nano the same expert as for memory.
Instruction and rule files (always on)
The known agent instruction and rule files. Protected inside every detected project root, recursively (** matches any depth), and never switchable off:
| Pattern | What it is |
|---|---|
**/CLAUDE.md | Claude Code project instructions |
**/AGENTS.md | Agent instructions (Codex, OpenClaw) |
**/GEMINI.md | Gemini CLI instructions |
**/.cursorrules | Cursor rules |
**/.clinerules | Cline rules |
**/.windsurfrules | Windsurf rules |
claude.md is the same file the agent loads as CLAUDE.md, so it is matched too.Agent configuration files
These configure what the agent is and what it may reach - which tool servers exist and what the workspace hands it. Watched inside already confirmed agent projects:
| Pattern | What it is |
|---|---|
**/.mcp.json | MCP tool-server configuration |
**/mcp.json | MCP tool-server configuration |
**/.vscode/tasks.json | VS Code tasks (only under .vscode/) |
tasks.json sits in countless ordinary dev projects, so it is not a trigger on its own.Config and hook files
Agent config and hook files, classified by their path (from model size Mini up a dedicated Melira expert evaluates them, with Nano the same expert as for memory):
| Pattern | What it is |
|---|---|
**/settings.json | Agent settings |
**/settings.local.json | Local agent settings |
**/setup.mjs | Agent setup hook |
The config route also includes the three agent-configuration files above (.mcp.json, mcp.json, .vscode/tasks.json).
Per-agent memory locations
The built-in registry ships default watch locations per agent, relative to the user home; the memory globs are relative to each agent root:
| Agent | Home path | Memory globs |
|---|---|---|
| Claude Code | .claude | **/memory/**, settings.json, settings.local.json, setup.mjs |
| OpenClaw | .openclaw | **/AGENTS.md, **/*.memory.md |
| OpenClaw Skills | .openclaw/skills | **/*.md |
| Agent Skills | .agents/skills | **/*.md |
| Cursor | .cursor | rules/** |
| Windsurf / Codeium | .codeium | **/memories/** |
| Cline | .cline | **/*.md |
| Continue | .continue | **/rules/** |
| OpenAI Codex | .codex | **/AGENTS.md |
| Gemini CLI | .gemini | **/GEMINI.md, settings.json |
Optional: all Markdown
- Off by default.
- The
ProtectAllMarkdowntoggle additionally covers every**/*.mdfile under a protected root.
node_modules are skipped when the watcher sets up recursively - one source of truth, no duplicate copy.Read next
Once you know what is watched, see how a change is judged and reverted: the poison0 agent is fail-closed and guards against memory poisoning.