autorun-audit lists every hook, task and MCP server a repo will run when you open it or start an agent

Shown on HN, the MIT scanner (uvx autorun-audit repo <url>) reads folder-open VS Code/Cursor tasks, Claude Code and Cursor hooks, unpinned MCP launches, dev container host commands, npm install scripts and hidden Unicode in AGENTS.md, then flags what can read credentials or hit the network and whether your tool asks first. It only reads files, never runs them, and ships a GitHub Action with SARIF output.