# Guides to AI coding agent security > AI agent security and developer OPSEC: Claude Code history, hooks and .env, MCP servers, prompt injection, token scopes and rotating a leaked key. Canonical: https://ranwhat.com/guides Walk-throughs for the agent on your own machine: what Claude Code writes to disk, what it can read, how to check what it ran, and how to cut what its tokens allow. Each guide is checked against the vendors' own documentation and lists its sources at the end. ## Start with the checklist. The other guides go deeper on one item each. This one puts them in order. ### [AI coding agent security: a checklist for your own machine](https://ranwhat.com/guides/ai-coding-agent-security) What a coding agent can reach, the boundary to put around it, what it writes to disk, how to check what it already ran, and how to scope the tokens it holds. Fourteen steps, in the order worth doing them. ### [Best AI coding agent security tools in 2026: the buyer's shortlist](https://ranwhat.com/guides/best-ai-coding-agent-security-tools) Six tools compared on five checks anyone can verify: agents covered, blocking, what stays local, licence and finding secrets in transcripts. Written by the maker of one of them, with the method shown and where each rival is stronger. ## What Claude Code keeps, reads and runs. Claude Code writes every session to a plaintext transcript under `~/.claude/projects`. These five guides cover what is in those files, what to do about it, and how to block a risky call. ### [Where Claude Code stores your conversation history](https://ranwhat.com/guides/claude-code-history) Where the transcripts are, what they hold, why they are deleted after 30 days by default, how to change that, and how to purge a project. ### [How to stop Claude Code reading your .env file](https://ranwhat.com/guides/claude-code-env-secrets) A Read deny rule stops `cat` and Claude's file tools, not `grep -r` or a Python script. The sandbox closes that gap. If it already read the file, rotate first. ### [A Claude Code audit log from what is already on disk](https://ranwhat.com/guides/claude-code-audit-log) Read back the tool calls in the transcripts you already have, then keep a record from now on with a hook or OpenTelemetry. ### [Claude Code deleted my files. What now?](https://ranwhat.com/guides/claude-code-deleted-files) Rewind does not restore files a Bash command removed. Find what was deleted and when, restore from git or a backup, and block a repeat. ### [Claude Code hooks for security: block risky tool calls](https://ranwhat.com/guides/claude-code-hooks-security) Block `rm -rf`, force pushes and `.env` reads before they run with PreToolUse hooks and deny rules, and learn where hooks stop working. ## Beyond one agent. Claude Code is one of many. These guides cover where the others keep their history, what an MCP server can reach, and how text in a repository becomes a command. ### [Where each AI coding agent keeps your conversation history](https://ranwhat.com/guides/ai-coding-agent-history-locations) Where Claude Code, Codex, Gemini CLI, Copilot CLI, Cursor, Aider, Windsurf, Cline and Continue keep chat history on disk, its format, and how to clear it. ### [Securing MCP servers for coding agents](https://ranwhat.com/guides/mcp-server-security-coding-agents) An MCP server runs with your privileges or holds your OAuth token. See what is configured, what to approve, and how to scope it in Claude Code. ### [Prompt injection in coding agents](https://ranwhat.com/guides/prompt-injection-coding-agents) Text in a README, issue or tool result can become a shell command. The documented attack chains, why a prompt cannot fix it, and what limits the damage. ### [How to check that AI-written code is secure](https://ranwhat.com/guides/check-ai-agent-code-is-secure) Tests, scanners and CI gates that check AI-written code without asking the model, and where the agent's own review stops being evidence. ### [A secure-by-default AI coding agent setup](https://ranwhat.com/guides/secure-by-default-ai-coding-agent-setup) One settings file and five habits that decide what a coding agent can reach before anything goes wrong: sandbox, deny rules, scoped tokens, reviewed tools and a record. ## What an agent's tokens allow. Permission prompts decide which commands run. The token decides what a command can do once it reaches the provider. ### [Check what the tokens your AI agent holds can do](https://ranwhat.com/guides/ai-agent-token-scopes) Check what GitHub, Google, Slack, Stripe and AWS credentials allow with each provider's own tools, see which grants were ever used, then cut them down to least privilege. ### [An AI agent saw my API key. What now?](https://ranwhat.com/guides/rotate-leaked-api-key-ai-agent) An agent read or printed your key. Rotate it at the provider first, check its logs, then mask the transcript and handle git history if needed. ## What the rest of the laptop gives away. The agent is one part of a developer's OPSEC. Cloud keys, SSH keys, registry tokens and shell history sit on the same disk. ### [Developer OPSEC: what your laptop and your AI agents give away](https://ranwhat.com/guides/developer-opsec) Where credentials sit on a developer laptop, what agent transcripts add, how to find and rotate what is already there, and how to keep the next one out of plaintext. Ten steps at the end. ## Or check your own machine now. One read-only pass over your Claude Code history: the risky actions the agent took, and the credentials left in its transcripts. It changes nothing. ``` $ uvx ranwhat check ``` [Install](https://ranwhat.com/install) `check` runs two commands together: [ranwhat watch](https://ranwhat.com/watch) for what your agents ran, and [ranwhat clean](https://ranwhat.com/clean) for secrets in their transcripts. [ranwhat scan](https://ranwhat.com/scan) is separate, and scores what their credentials allow.