It depends on where the agent keeps its settings and on the mode it starts in. On Windows, Claude Code keeps its configuration in 9 kinds of files, and 6 of them can hold keys in plain text, according to the RosmarOps Observatory (reviewed 28 October 2026).
Claude Code (Anthropic). 9 kinds of files; 6 can hold keys in plain text: the three settings files, %USERPROFILE%\.claude.json, <project>\.mcp.json and %USERPROFILE%\.claude\.credentials.json. It starts in auto mode, where another AI model answers what would otherwise be asked. Without asking, it can read files in the folders it works in and run its built-in read-only commands, which work on any path unless blockReadsOutsideWorkingDirectories is set; other reads outside those folders are asked.
Cursor (Anysphere). 6 kinds of files; 2 can hold keys in plain text: its MCP files, %USERPROFILE%\.cursor\mcp.json and <project>\.cursor\mcp.json. Its documentation recommends auto-review mode, where another AI model decides. Without asking, it can read files inside and outside the folders it works in: its Read Access setting defaults to System since Cursor 3.23. Its file tools refuse credential files covered by its default ignore patterns.
Hermes Agent (Nous Research). 5 kinds of files; 4 can hold keys in plain text, all under %LOCALAPPDATA%\hermes. It starts in smart mode: commands that match a dangerous pattern go to another AI model, and other commands run without asking. According to its documentation and source code, it can read any path without asking, except its own credential files, and when it has no login of its own it borrows the Claude Code and Codex logins from their credential files.
What «can hold keys in plain text» means. The file format lets a key be written as text, for example in an environment block or an MCP server entry. It does not mean your file has one; that depends on your machine.
Every fact above has its date and source on each agent’s Observatory page.
RosmarOps shows which keys on your computer each agent it evaluates can read without asking you, and sends nothing.