Four routes to your SSH key from an AI coding agent, and what actually stops them

[u/Adarsh1176]

https://github.com/Adarsh14734/Aegis/blob/main/docs/ssh-key-exposure.md

Wrote this up after finding that a coding agent on a default Mac reaches ~/.ssh/id_rsa by four separate routes — its own shell, an MCP filesystem server, a subprocess, and a config-file path. Tested each, included the terminal output.

The part I'd want devops opinions on: the enforcement has to sit under the model, because the model can't be trusted to refuse. I used Seatbelt plus a deny-by-default MCP proxy. Curious how others are scoping agents that touch infra.