The ones worth answering up front.
Does it send anything anywhere?
No. The watcher reads transcripts your agents already wrote to disk and prints to your terminal. The scanner talks only to the credential's own issuer when you ask it to introspect a token. There is no telemetry, no account and no server.
Does it need my credentials?
The watcher needs none at all. Point it at your machine and it works. The authority scanner can introspect tokens read-only, but it never exercises a permission and never needs a write-scoped credential. Pass tokens through the environment rather than the command line, because anything in argv is readable by every user on the machine.
Which agents does it read?
Claude Code and OpenClaw today. Codex and an OTLP receiver are next, which will cover anything emitting OpenTelemetry GenAI spans. It reads files the agent already wrote, so there is no wrapper, no proxy and nothing in your critical path.
Will it slow my agent down?
No. It runs after the fact against files on disk. Your agent never knows it exists.
Is it safe to run clean --apply?
It reports by default and changes nothing until you ask. When you do, it writes a timestamped backup first, then parses the rewritten file back before replacing the original, so a transcript is never left corrupted. Ordinary config, templates and placeholders are left alone.
If I mask a secret, is it safe now?
No, and the tool says so. The value was already written to disk in plaintext and already sat in a model context you do not control. Masking stops it leaking a second time. Rotating it is the actual fix, which is why the report leads with what to rotate and where.
How is this different from scanning my agent's config?
Tools that scan agent components look for known-bad content in what is installed: MCP servers, skills, configuration. ranwhat looks at what your agent actually did with the access it has, and what it is still allowed to do next time.
What does it cost?
Nothing on your own machine, forever, and the code is MIT licensed with no dependencies. Paid tiers exist for collecting records across machines and for evidence retention. We never charge per finding, because a tool paid by the alert has a reason to cry wolf.
Does it work on Linux and Windows?
Linux yes. Windows is untested. It is pure Python with no platform-specific calls, so it will probably work, but nobody has verified it. Tell us if you do.