# Every release, and what changed. > Every ranwhat release, newest first: the agents it reads, the rules it gained and what it fixed. Get the next one by email or follow the RSS feed. Canonical: https://ranwhat.com/updates Last updated: 2026-10-14 What each version of ranwhat added and fixed, newest first. Get the next one by email or RSS. The [commit history](https://github.com/MatijaMiki/ranwhat/commits/main) has the reasoning behind every change, including what the tool got wrong. ## Get the next release. One short email when a version ships, saying what changed. Nothing else, and every email has a link to stop. The emails are sent by Resend ([privacy](https://ranwhat.com/privacy#updates)). Nothing is sent until you confirm from your inbox. ### Or follow the RSS feed ``` $ https://ranwhat.com/rss.xml ``` Paste it into any feed reader, or [open the feed](https://ranwhat.com/rss.xml). GitHub has a feed of its own for [every commit](https://github.com/MatijaMiki/ranwhat/commits/main.atom). ## Releases, newest first. Run the newest with `uvx ranwhat@latest check`, or bring an install up to date with `pipx upgrade ranwhat`. 0.7.0 14 October 2026 ### Callers, revoke, bench and thirteen watch rules - New: [ranwhat callers](https://ranwhat.com/commands#callers) asks the provider’s own log who used a key: AWS CloudTrail by access key ID, and a GitHub organisation’s audit log by token hash. `--mine CIDR` marks your own addresses, and callers outside them are flagged. It is read-only. - New: [ranwhat revoke](https://ranwhat.com/commands#revoke) lists the Claude Code settings that let an agent act without asking: `bypassPermissions`, `enableAllProjectMcpServers`, and allow rules for any shell command, `curl`, `rm`, `git push` or a credential file. `--apply` takes them back and keeps a copy of each file. - New: [ranwhat bench](https://ranwhat.com/commands#bench) plants fake secrets and risky commands in a temporary directory, runs the detection `check` uses over them, and scores it against an answer key. What ranwhat is known not to catch is listed apart from the score. It sends nothing, and exits 3 when an expectation is not met. - [watch](https://ranwhat.com/watch) has four new rules, for thirteen in all, up from nine. They are a script fetched from the network and run in the same command, files made writable by every user, container volumes or every container removed, and a command hidden in base64, hex or printf escapes and then run. That last one is decoded without being run and judged by the other rules, so an encoded `rm -rf ~` is reported as that deletion too. - The new rules can report calls that 0.6.0 did not, so a pipeline that runs `check --fail-on` may start failing after the upgrade. - `clean`’s review links the provider’s rotation page for each leaked key, and `open N` opens it. 0.6.0 7 October 2026 ### Twenty coding agents, accounts and a Claude Code hook - `check`, `watch` and `clean` read Cursor, Windsurf, Cline, Roo Code, OpenCode, Continue, Aider and Goose too, twenty coding agents in all, each from the history it keeps on disk. Windsurf is read from the plaintext transcripts its Cascade hook writes. - New: [ranwhat login](https://ranwhat.com/commands#login) links a machine to an optional account at account.ranwhat.com. It prints a code to type at ranwhat.com/device, signed in, and the machine gets a token of its own for `update`. `ranwhat whoami` says whose a token is, and `ranwhat logout` revokes the machine’s token and deletes it. Nothing that runs locally needs an account. - New: [ranwhat reach](https://ranwhat.com/commands#reach) lists the MCP servers your agents are configured with and what each runs or connects to, flags a secret written inline or a package fetched at no fixed version, and lists the credential files no Claude Code deny rule covers. It writes nothing. - New: [ranwhat hook install](https://ranwhat.com/commands#hook) adds an opt-in Claude Code hook, so a call watch would rate high or critical waits for your yes before it runs. It judges on your machine and sends nothing. - `check`, `watch` and `clean` take `--fail-on SEVERITY`, which exits 3 when anything at or above it is found, and `--sarif PATH` for code scanning. The repository’s `action.yml` runs them in GitHub Actions. - `keep` in `clean`’s review is remembered, so a value you keep is not reported again. - The bundled catalogue rates 204 scopes across twelve providers, up from 104, taking in the 100 the Plus feed added after 0.5.0. - On a terminal, `scan`, `live` and `update --status` may add one dim line about the Plus feed, never with `--json`. `RANWHAT_NO_HINTS=1` turns it off. - `watch` flags `aws s3 rb` as a cloud delete. 0.5.0 4 October 2026 ### Twelve coding agents - `check`, `watch` and `clean` read twelve coding agents, each from where it keeps its history: Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Qwen Code, Grok Build, Droid, Kimi Code, Kimi CLI, Pi, Muse Code and OpenClaw. - New: [ranwhat sources](https://ranwhat.com/commands#sources) lists every agent and where it looked. `--source ID` reads one agent, and `--path ID=PATH` reads one from somewhere else. - `clean` knows each value by a salted fingerprint, so masking it once masks every copy, including one another program wrote with different escaping. - Agents’ databases, such as Codex’s thread index and OpenClaw’s, are searched for secrets read only, and the report says how to remove one in the agent itself. - On Windows, suggested commands are quoted to paste into cmd or PowerShell. 0.4.0 3 October 2026 ### Sharper watch and clean - `watch` spots a local file sent off the machine: piped or posted to curl, wget or nc, including through head, gzip, jq or sed. - `watch` reads what the shell really runs inside quotes, `$'...'` and a wrapped shell, and ranks deleting your home directory critical however it is spelled, `\rm` included. - `watch` masks the secrets in the commands it quotes, and `check` masks in its watch section every secret its clean section found. - Reads the transcripts that subagents write. - Fewer false alarms: placeholders, settings constants and AWS ARNs read as what they are, not as secrets. - `clean` and `watch` stay linear in time on hostile input, such as a megabyte of crafted text or one enormous shell command. 0.3.0 26 September 2026 ### One command for both, and a faster clean - New: [ranwhat check](https://ranwhat.com/commands#check) runs `watch` and `clean` in one read-only pass. It changes nothing; masking stays a choice you make in `clean`. - `clean` went from 89 seconds to 2.1 on a 39 MB transcript, with the same findings. It no longer searches pasted screenshots, which cannot hold a credential. - Output fits your terminal’s width, and `NO_COLOR` is honoured. 0.2.1 26 September 2026 ### Commands you can run - Run through `uvx`, the overview suggests `uvx ranwhat demo`, because a bare `ranwhat` is not on your PATH there. - The capability catalogue covers HubSpot, Discord, GitLab, Atlassian, Microsoft Graph, Sentry and Shopify. 0.2.0 26 September 2026 ### A catalogue that can be refreshed - `ranwhat update` refreshes the capability catalogue from ranwhat’s feed, for Plus subscribers once Plus opens. It sends the subscription token and nothing else. - Without a feed every command still runs on the catalogue bundled with the release, and a damaged cache falls back to it. 0.1.1 23 September 2026 ### A first run that answers - A bare `ranwhat` prints what each command does and where to start, instead of a usage error. 0.1.0 23 September 2026 ### First release - `watch` reads what Claude Code and OpenClaw ran and surfaces the irreversible actions worth knowing about. - `clean` finds credentials left in Claude Code’s transcripts and masks them when you ask. - `scan` and `live` score what an agent’s credentials allow, and `demo` shows a scan on an example.