I spent a couple of weeks scanning merged pull requests opened by coding agents Devin, GitHub Copilot's coding agent, Codex, Claude Code, and Cursor across public repositories. 2,204 of them, read-only through the GitHub API, no LLM judgment anywhere, just deterministic checks.
The number that stuck with me: zero of the 2,204 declared, in any machine-checkable form, what they intended to change. Not "most didn't" zero.
Of the 349 that touched CI workflows or package manifests, 12.9% escalated workflow permissions and 17.5% added unpinned actions. 3.9% edited the files that steer every future agent run (AGENTS.md, CLAUDE.md, .mcp.json).
Most of those are probably fine. That is sort of the point: nobody declared them, so nobody can tell the difference without reading every diff by hand.
AI coding agents open PRs all day. Who checks they stayed in bounds? MergeWarden is a checkout-free GitHub Action and CLI that gates AI-agent PRs against your repo's boundaries: declared scope, agent-control-plane drift (AGENTS.md, .mcp.json), and workflow permission escalation. No checkout, no LLM, deterministic replayable evidence. See what it catches in one command, no token or repo: npx mergewarden demo. Built after scanning 2,204 merged agent PRs: zero declared their scope. MIT.
