# Agents got credentials before anyone built the recorder.

> Coding agents run commands with your credentials. Claude Code keeps the record as a transcript for 30 days by default. AI agent security, built in the open.

Canonical: https://ranwhat.com/about

Sometime in the last two years the assistant stopped suggesting commands and started running them. In Claude Code, the record of what it ran is [a plaintext transcript, deleted after 30 days by default](https://ranwhat.com/guides/claude-code-history).

An agent on a developer's laptop today holds a shell, a GitHub token, a cloud role and whatever was in the `.env` file it read on the way past. In production it may hold a payments key. [Claude Code's own documentation](https://code.claude.com/docs/en/claude-directory#plaintext-storage) is plain about what happens next: anything that passes through a tool is written to a transcript on disk, in plaintext.

The question that matters after something goes wrong is short: **what did the agent do, and under whose authority?** The transcript holds most of the answer until Claude Code deletes it. Latency dashboards do not hold it at all.

That gap is the whole product. Not detecting a villain, since there usually isn't one. Producing a record of irreversible actions that holds up when somebody outside the company asks.

It is one part of [AI agent security](https://ranwhat.com/guides/ai-coding-agent-security): the record of what already ran, what leaked, and what the credentials still allow. It blocks nothing while the agent works unless you install its hook, which asks before a call it rates high or critical. Claude Code's permission rules, hooks and sandbox do the rest.

## What happened, and what could happen next.

### The watcher

Reads what Claude Code and twenty-nine other coding agents already wrote to disk and surfaces the handful of irreversible actions worth knowing about. No wrapper, no proxy, nothing in the critical path, unless you install the hook.

### The scanner

Reads the credentials an agent holds, read-only, and scores authority, observability and reversibility. Tells you which permissions were granted and never once used: full liability, zero utility.

## Four decisions everything else follows from.

01

### Precision over recall

A watcher that cries wolf gets muted in a day, and a muted watcher records nothing anyone reads. Searching for a dangerous string, writing a script that contains one, and deleting a build directory are all not actions. Getting that right cost more work than the detection itself.

02

### Evidence, not intelligence

The product is not a judgement about whether an action was allowed. You asked the agent to do things. It is a record of what happened that a third party can check.

03

### Local unless you ask

Anything touching a secret runs locally. Introspection talks only to the credential's own issuer, and update sends only your token to our server. login, whoami and logout, which link a machine to an optional account, are the only other commands that talk to it, except push, which you run yourself and which sends derived metadata only (rule, severity, agent, time, counts). This is an architecture rather than a promise, which is why it is short to review.

04

### Say what you don't know

A provider whose usage can't be verified is reported as unverified, never as clean. An unrecognised permission is flagged, never assumed safe. A confident wrong answer is worse than no answer.

## Built by Matija Mikulinec.

One person, working in the open from Zagreb under the name Cenner. The code is MIT licensed with no runtime dependencies, because a tool you point at your own credentials should be one you can read end to end in an afternoon.

Everything this site says the command-line tool does, it does. The precision rules come from two runs on real history and from probing a released build. The first watch build flagged six findings, and three were false positives: a grep for `rm -rf`, the same string inside a Python one-liner, and a heredoc being written to a file. A later release reported fifteen findings on one machine's 90-day history, and eleven were true but uninteresting deletions of build and temp directories. After the fix, the same history gave four. Probing a released build found the rest: an `rm -rf` inside an echo or a comment, and `git rm --cached`, which only unstages. The fixes are in the commit history, with the reasoning.

### Where it is

Alpha, and honestly so. The local tools ship today and are tested. Plus’s catalogue feed is live; the hosted and evidence tiers are being built. If that interests you more than it worries you, the repository and the issue tracker are the front door.

[Repository](https://github.com/MatijaMiki/ranwhat) [Pricing](https://ranwhat.com/pricing)

## What the catalogue knows.

12 providers and 204 permissions, each mapped to what it actually lets an agent do: whether it can be undone, what it reaches, and the sentence explaining why that matters.

| Provider | Scopes | Of which |
| --- | --- | --- |
| **Google Workspace** | 21 | 9 destructive, 1 financial |
| **GitHub** | 20 | 10 destructive, 2 financial |
| **Microsoft 365** | 20 | 12 destructive |
| **HubSpot** | 19 | 2 destructive, 5 financial |
| **Shopify** | 18 | 3 destructive, 8 financial |
| **Discord** | 17 | none |
| **AWS** | 16 | 10 destructive |
| **Atlassian** | 16 | 10 destructive |
| **Sentry** | 16 | 8 destructive |
| **Slack** | 15 | 4 destructive |
| **GitLab** | 15 | 5 destructive |
| **Stripe** | 11 | 1 destructive, 7 financial |

A permission that is not catalogued is not assumed safe. It gets classified by its action verb and flagged as unclassified, so the gap shows up in the report rather than hiding in it.

The list grows as providers ship scopes. Missing one you rely on? [Tell us which →](https://ranwhat.com/contact?about=other)