FAQ
Questions about ranwhat
What it reads, what it sends, what it changes, and where it fits in AI agent security, secret scanning and OPSEC.
The ones worth answering up front.
Does it send anything anywhere?
Not unless you ask it to. check, watch, clean, reach, scan and demo read files on disk and print to your terminal. live, callers, --pull-usage and revoke in clean’s review ask only the provider that issued each token. update fetches the capability catalogue for Plus and sends only your token. login, whoami and logout talk only to ranwhat.com. push, which you run yourself, sends derived metadata (rule, severity, agent, time, counts) to feed.ranwhat.com for your Plus organisation, and --dry-run prints exactly what it would send; see privacy. There is no telemetry, and the tool needs no account. An optional account at account.ranwhat.com manages Plus, and ranwhat login links a machine to it only if you run it.
Does it need my credentials?
The watcher needs none at all. Point it at your machine and it works. The authority scanner can introspect tokens read-only, but it never exercises a permission and never needs a write-scoped credential. Pass tokens through the environment rather than the command line, because anything in argv is readable by every user on the machine.
Which agents does it read?
Claude Code, Codex, Gemini CLI, Antigravity, GitHub Copilot CLI, GitHub Copilot in VS Code, Cursor, Windsurf, Cline, Roo Code, Kilo Code, OpenCode, Continue, Aider, Goose, Zed, Warp, Amazon Q, Qwen Code, CodeBuddy, Grok Build, Droid, Kimi Code, Kimi CLI, Pi, Oh My Pi, Muse Code, Mistral Vibe, DeepSeek Harness and OpenClaw, from the history each writes to disk. check, watch and clean read all thirty by default, and ranwhat sources says where it looked for each. Cursor keeps its history in a database, Zed keeps its history in a database, Warp keeps its history in a database, Amazon Q keeps its history in a database or in a file its language server rewrites every second, and OpenClaw keeps its history in a database too, so clean finds their secrets but only reads them. Windsurf keeps Cascade's own history encrypted, so ranwhat reads the plaintext transcripts its post_cascade_response_with_transcript hook writes. Meta Muse, Grok Bot and the current Amp keep theirs in their vendor's cloud, so there is nothing on your machine to read. It reads files the agent already wrote, so there is no wrapper, no proxy and nothing in your critical path, unless you install its Claude Code hook.
Does it read everything Claude Code writes?
Not yet. It reads the session transcripts, ~/.claude/projects/*/*.jsonl, and the transcripts their subagents write, for the last 30 days by default. The large tool outputs Claude Code stores in separate files, and ~/.claude/history.jsonl, are not read yet. If CLAUDE_CONFIG_DIR is set, it reads $CLAUDE_CONFIG_DIR/projects instead, and --root PATH points it at any other directory. A run that reads nothing says that nothing was checked, rather than that nothing was found. The Claude Code history guide lists what each of those files holds and how long it stays.
Will it slow my agent down?
Not unless you install the hook. Otherwise it runs after the fact against files on disk, and your agent never knows it exists. With the hook, Claude Code asks it about each tool call first, which takes about a fifth of a second.
Is it safe to run clean --apply?
It reports by default and changes nothing until you ask. When you do, it writes a timestamped backup first, then parses the rewritten file back before replacing the original, so a transcript is never left corrupted. Ordinary config, templates and placeholders are left alone.
If I mask a secret, is it safe now?
No, and the tool says so. The value was already written to disk in plaintext and already sat in a model context you do not control. Masking stops it leaking a second time. Rotating it is the actual fix, which is why the report leads with what to rotate and where.
How is this different from scanning my agent's config?
Tools that scan agent components look for known-bad content in what is installed: MCP servers, skills, configuration. ranwhat looks at what your agent actually did with the access it has, and what it is still allowed to do next time. Its reach command does read your agents' MCP server configuration, for secrets written inline, packages fetched at no fixed version and remote URLs, and lists the credential files no Claude Code deny rule covers. It does not inspect a server's code, its tool descriptions or skills for malicious content.
Is ranwhat a security tool for Claude Code?
It covers one part of AI coding agent security: what Claude Code and other coding agents already ran, the secrets they left in their transcripts, and what an agent's credentials still allow. It does not block anything while the agent works unless you install its hook, ranwhat hook install, which makes a call watch would rate high or critical wait for your yes. Beyond that, Claude Code has permission rules, hooks and a sandbox.
Is ranwhat a secret scanner?
For one place repository secret scanning does not look: the transcripts coding agents keep in your home folder. clean finds API keys, tokens, private keys and passwords typed into commands there, says what to rotate, and masks them when you ask. For your git history and the rest of the disk, run a scanner such as Gitleaks or TruffleHog as well.
Does ranwhat help with OPSEC?
With the part that sits on your own disk. Coding agents keep plaintext transcripts of what they ran and read, and credentials end up in them. clean finds those and says what to rotate, watch shows which commands read credential files, sources shows which agents kept history on the machine, and scan shows what a leaked token could do. reach lists the credential files, ~/.aws/credentials and ~/.ssh keys among them, that no Claude Code deny rule keeps from an agent, by path only. It does not search the rest of the laptop for secrets, your shell history among it: the developer OPSEC guide covers that part.
What does it cost?
Nothing on your own machine, forever, and the code is MIT licensed with no dependencies. Plus is €12 a month, or €120 a year, per organisation (price on 4.10.2026, when it went on sale: the same; price list). It keeps the capability catalogue current and shows every machine's findings side by side with ranwhat push; evidence retention is being built. We never charge per finding, because a tool paid by the alert has a reason to cry wolf.
Does it work on Linux and Windows?
Yes, and macOS too. CI runs every test on Linux, macOS and Windows, on every change. It is pure Python with no dependencies. Tell us if something breaks.