ranwhat check
Runs watch and clean in one read-only pass: what your agents ran, and what they left on disk. It never changes anything.
Flight recorder for AI agents
Find out what your AI agents actually did.
Claude Code has your shell, your keys and your repo. ranwhat reads what it ran, surfaces the handful of actions worth knowing about, and does it on your own machine.
$
uvx ranwhat check
Install
2 critical 1 high * Credential material accessed 2026-09-30 18:13:00 Bash cat ~/.ssh/id_rsa -> The agent read a file whose only purpose is to hold secrets. Whatever it read is now in a model context you do not control. * Bulk or recursive deletion 2026-09-30 15:13:00 Bash rm -rf .frames -> Recursive deletion. Recoverable only if something else was backing it up. * Package or release published 2026-09-30 14:58:00 Bash npm publish --access public -> Something was pushed to a registry other people may install from. Supply-chain reach, and usually irreversible. ------------------------------------------------------------ Read locally. Nothing was transmitted.
01 / Commands
What it did, what leaked, what it may do next.
ranwhat is an open-source command-line tool for AI coding agent security. It reads what Claude Code and twenty-nine other coding agents have already written to disk: what they ran, and which credentials leaked into their history. scan adds what their tokens still allow. Only clean changes your files, and only when you ask it to.
ranwhat watch
Reads what your agents already ran and raises the handful of irreversible actions worth knowing about.
ranwhat clean
Finds credentials sitting in plaintext in your agents' transcripts, tells you what to rotate, and masks them when you ask.
ranwhat scan
Scores the authority your agent's credentials carry, and which permissions it has never once used.
02 / Install
Thirty seconds, no signup.
Python 3.9 or newer. No dependencies. Point it at your own machine and see what the last month looked like.
$
uvx ranwhat check
Prefer it on your path? pipx install ranwhat
or pip install ranwhat.
Nothing to build locally.
03 / Questions
AI agent security, in plain terms.
What is AI agent security, and how is it different from LLM security?
LLM security is about the model and what it says: jailbreaks, harmful output, leaked training data. AI agent security is about what an agent does once it has tools and credentials: the commands it runs, the files it reads, the tokens it uses. Prompt injection is how an attacker steers it. ranwhat covers the agent side, on your own machine and after the fact. It does not detect prompt injection, and blocks nothing while the agent works unless you install its Claude Code hook. The AI coding agent security checklist covers the parts it does not.
Can an AI coding agent leak my API keys?
Yes, in two ways. It can write a key into code it commits, which is what repository secret scanners look for. And when a command it runs prints a key, through cat .env, env or a config file, the output is saved in its transcript in plaintext and sent to the model as context. Repository scanners do not look there. ranwhat clean finds those copies and tells you what to rotate.
What should I do if an AI agent exposed my API key?
Rotate it at the provider first: create the replacement, revoke the old key, then check the provider's logs for use you do not recognise. Deleting or masking the transcript does not undo the leak, because the value has already been on disk and in a model context. Masking only stops those copies leaking again. ranwhat clean leads with what to rotate and where, and masks the copies on disk when you ask.
How do I audit what an AI agent did on my machine?
Read back the history it already wrote. Most coding agents record each tool call they make, with its output, and that record is an audit trail you can search. ranwhat watch runs sixteen rules over it: credential reads, rm -rf, force pushes, npm publish and more. History expires, Claude Code's after 30 days by default, so for a record from now on add a hook or OpenTelemetry, as the audit log guide shows.
What does least privilege mean for an AI agent's tokens?
The agent gets its own token, with only the scopes its task needs and an expiry date, rather than your own admin key. A permission prompt decides which command runs; the token decides what that command can do once it reaches GitHub, Stripe or AWS. ranwhat scan scores what an agent's tokens allow, read-only, from a catalogue of 204 scopes across twelve providers, and --pull-usage shows which grants were never used, where the provider keeps a record.
What does OPSEC mean for a developer who uses AI agents?
OPSEC, operations security, is keeping information an adversary could use out of their reach. On a developer's laptop that information is mostly credentials: shell history, .env files, keys in ~/.aws and ~/.ssh, and now agent transcripts, which keep tool output in plaintext in your home folder. Anything that can read your files can read those, malware included. In practice: know what is there, rotate what leaked, and keep secrets out of the agent's reach.
When is the free version enough, and when would I pay?
If you run agents on one machine, the free version is the whole tool: every rule, every source and every report, with nothing held back. Plus is for what needs a server, such as a catalogue kept current as providers add scopes, CI tokens, invited teammates and a view across machines today, and longer retention and alerts as they are built. It is one flat price per organisation, whether you run two agents or two hundred. See the side-by-side comparison.
04 / Guides
Guides for the agent on your machine.
The OPSEC of running an AI agent on your own machine: where Claude Code keeps what it saw, how to keep your secrets out of it, and what to do when something has already gone wrong. Each one is checked against the vendors' documentation and lists its sources.
- AI coding agent security checklistfourteen steps, in order
- Where Claude Code keeps your history~/.claude/projects, 30 days by default
- How to stop Claude Code reading your .env filedeny rules and the sandbox
- Claude Code audit logevery tool call it already made
- Claude Code deleted my fileswhat rewind cannot restore
- AI agent token scopesleast privilege, provider by provider
- Developer OPSECwhat your laptop and your agents give away
- Claude Code hooks for securityblock rm -rf, force pushes and .env reads
- Prompt injection in coding agentshow text becomes a command
- MCP server securitywhat a server can reach
- Rotate a leaked API keyprovider by provider
- A secure-by-default setupthe settings that limit an agent
- Checking AI-written codechecks that do not ask the model
- Best AI agent security toolssix compared on five checks
05 / Follow
Built in the open.
New sources and rules ship regularly, and the commit history carries the reasoning, including the things the tool got wrong and what changed because of it.
06 / Listed
Where else it is listed.
Directories and launch sites that list ranwhat. Each badge is an image served by or for its directory, so your browser asks that host for it, and the privacy page names every host.
