ranwhat scan

Score the authority your agent's credentials carry.

ranwhat scan reads the credentials an agent holds, read-only, and scores authority (what it may do), observability (whether a past action can be reconstructed) and reversibility (whether a wrong action can be undone).

$ ranwhat demo

Install

01 / Authority

What it's allowed to do next time.

The watcher tells you what the agent already ran. The scanner tells you what it could do next, from the credentials it holds, scored on the three things that determine your exposure.

From ranwhat demo, the bundled support-copilot example.

Authority

19/100 · F

Observability

25/100 · F

Reversibility

24/100 · F

Least privilege 23 permissions granted, 15 never exercised. Five of those can move money or destroy data: full liability, zero utility.

Blast radius Unbounded financial authority. 13 irreversible actions reachable with no approval gate.

Reconstruction Traces don't carry tool name, arguments or credential identity. You can't answer what the agent did on Tuesday, or under whose authority.

Evidence grade Usage is verified self-attested or unverified per provider, never silently assumed clean.

Catalogued capability semantics for 204 scopes across twelve providers: Google, GitHub, GitLab, Microsoft 365, Slack, Discord, Stripe, Shopify, HubSpot, Atlassian, Sentry and AWS. Unrecognised scopes are classified by action verb and flagged as unclassified, never assumed safe.

See a full report, as the CLI writes it →

02 / Commands

An example first, then your own credentials.

A profile is a JSON file naming the agent, each credential, the scopes it was granted and the controls around it, in the shape of the bundled example. live builds one by asking each provider instead.

ranwhat demo                                  the bundled example, no setup
ranwhat scan profile.json --html report.html  score a profile, write a report
read -rs RANWHAT_GITHUB_TOKEN                 paste it: not echoed, not saved to history
export RANWHAT_GITHUB_TOKEN
ranwhat live                                  ask each provider, read-only
ranwhat scan profile.json --pull-usage        which grants were used

Pass tokens in the environment as RANWHAT_<PROVIDER>_TOKEN. A token passed as a flag still works, but prints a warning: argv is visible to every user on the machine through the process table.

Once you know what an agent can do, scope the tokens it holds down to what it uses.

03 / Axes

Three questions, and one of them can veto.

Axis	Question
Authority	What is it allowed to do?
Observability	Can you reconstruct a named past action?
Reversibility	Can a wrong action be undone?

Observability vetoes the overall verdict. An agent that cannot reconstruct its own tool calls is indistinguishable from the worst case.

04 / Evidence

Which grants were used, and how anyone knows.

State	Meaning
Verified	Pulled from the provider's own audit trail
Self-attested	Declared in the profile, not independently pulled
Unverified	No evidence at all, and the scopes are not assumed safe

Introspection Google through tokeninfo, GitHub through the scopes header on an authenticated call, Slack through auth.test, and Stripe by key prefix, where an sk_ key is treated as unrestricted. A token that comes back with no scope list, such as an rk_ restricted key or a fine-grained GitHub token, is left out of the scores and reported as a high finding, so it is never counted as harmless: declare its scopes in a profile and use scan instead.

By hand To check a token's scopes yourself, provider by provider: AI agent token scopes.

Usage pulls Read-only, over the last 90 days by default (--window-days): AWS IAM service last accessed, the GitHub organisation audit log (--github-org), Stripe events, and Google Admin SDK reports. There is no Slack pull, so Slack usage is self-attested or unverified.

Where tokens go Each token goes only to the provider that issued it.