Scan your Claude Code and Codex CLI session transcripts for secrets that leaked into the conversation and risky shell commands the agent actually executed.
AI coding agents read .env files, cat output that contains credentials, and run shell commands on your
behalf — and all of that gets written verbatim into local session transcripts (Claude Code:
~/.claude/projects/**/*.jsonl, Codex CLI: ~/.codex/sessions/**/*.jsonl). Those files are rarely audited,
rarely gitignored from backups, and can sit around for months. agent-audit finds what's in there before
someone else does. Running it with no arguments scans every known agent's default log directory at once.
If you build on Ethereum/EVM chains, this matters more than usual. A leaked API key is a bad day; a
seed phrase or private key that passed through an agent's session — from a .env cat, a debug print, a
"here's my wallet for testing" — is funds gone, no recourse, no support ticket to file. agent-audit
checks for that specifically: real BIP-39 wallet mnemonics (validated against the actual 2048-word spec
list, not a guess) and Ethereum private keys, alongside Infura/Alchemy RPC URLs with embedded project keys.
It also knows about Hardhat's famous public default test mnemonic and won't cry wolf over it.
$ npx github:CrypLed/agent-audit
agent-audit — scanned 59 session file(s), 3 finding(s)
[CRITICAL] SECRET: Database Connection String with Credentials
value: post…t_db (64 chars)
file: ~/.claude/projects/-home-you-billing-service/7dc5....jsonl:21
context: role=user tool_result at 2026-08-20T21:10:47.890Z
[HIGH] RISKY COMMAND: Download-and-execute via pipe to shell
value: curl https://example.com/install.sh | bash
file: ~/.claude/projects/-home-you-infra/a2f1....jsonl:14
context: role=assistant tool:Bash
Summary: 1 critical, 1 high
Values are always redacted (first/last few characters only) — agent-audit never prints a usable secret,
even to your own terminal.
Secrets: AWS keys, Google API keys/OAuth secrets, GitHub (classic, fine-grained, OAuth) and GitLab
tokens, Slack bot/user tokens and webhooks, Stripe secret/restricted keys, OpenAI and Anthropic API keys,
Hugging Face and PyPI tokens, npm tokens, Twilio SIDs, SendGrid/Mailgun/Mailchimp keys, Discord bot tokens,
Square/Shopify/Vercel/DigitalOcean/Doppler/Linear/Databricks/Heroku/Facebook tokens, PEM private key blocks,
JWTs, database connection strings with embedded credentials, and generic api_key=.../password=...
assignments. Shapes are sourced from each provider's actual documented format (cross-checked against
odomojuli/regextokens, a maintained, tested catalog), not
guessed — every added pattern has a test proving it matches a real-shaped token and rejects a malformed one.
Web3-specific: crypto wallet seed phrases (BIP-39 mnemonics, checked word-by-word against the real
2048-word spec list — not a fuzzy guess, since a valid mnemonic is by definition 100% real wordlist words),
Ethereum private keys (gated on nearby context like privateKey:, since a bare 64-hex-char string is
indistinguishable from an ordinary transaction hash otherwise), and Infura/Alchemy RPC URLs with embedded
project keys. Hardhat's well-known public default test mnemonic is recognized and reported as informational
rather than critical, since it controls no real funds by design and flagging it as a leak would just be
noise for the majority of Ethereum projects that use it locally.
Risky commands the agent ran: rm -rf / style destructive deletes, curl | bash/curl | python3 remote
code execution, base64-obfuscated payloads piped to a shell, fork bombs, reverse and bind shells (including
the classic Python pty.spawn one-liner), recursive chmod 777, raw disk writes (dd/mkfs), shell-history
tampering, firewall disabling, authorized_keys writes, local files uploaded via curl -F, packages
installed from a raw URL instead of a registry, LD_PRELOAD injection, docker run --privileged,
plaintext git credential storage, immutable-flag tampering (chattr), force-pushes to main/master,
DROP TABLE/DROP DATABASE, and crontab persistence.
npx github:CrypLed/agent-auditor clone and install globally:
git clone https://github.com/CrypLed/agent-audit && cd agent-audit
npm install -g .
agent-audit(not yet on the npm registry — coming soon)
agent-audit Scan every known agent's default log dir (Claude Code, Codex CLI)
agent-audit --dir <path> Scan a custom directory of transcripts (pair with --agent)
agent-audit --file <path> Scan one specific transcript file (repeatable, pair with --agent)
agent-audit --agent <claude-code|codex>
Which parser to use with --dir/--file (default: claude-code)
agent-audit --json Machine-readable output, for CI
agent-audit --fail-on <severity> Exit non-zero at/above this severity (default: high)
Run it as a pre-merge gate so a transcript with a live secret or a dangerous command never lands in a backed-up log directory unnoticed:
- run: npx github:CrypLed/agent-audit --fail-on criticalOr use it as a GitHub Action directly:
- uses: CrypLed/agent-audit@main
with:
fail-on: criticalAgentic coding tools are now doing real work inside real codebases — reading .env files, running shell
commands, calling internal APIs — and every one of those actions is being logged locally, verbatim, by
design (so you can resume sessions and so the agent has memory). That's a new, mostly-unaudited class of
secret sprawl. agent-audit is a first pass at making that visible.
vs. GitHub's MCP-server secret scanning: GitHub has a preview feature that scans your current code
changes for secrets on-demand, before a commit/PR, via an MCP tool call — different surface, and it
requires GitHub Secret Protection (paid) plus an explicit invocation each time. agent-audit scans the
session transcript retroactively — catching secrets that passed through the conversation (e.g. cat .env
output, an API response) without ever touching a committed file — and also flags risky commands the agent
executed, which that feature doesn't cover. Free, local, no setup, complementary rather than overlapping.
100% local. No network calls, no telemetry, nothing leaves your machine. Read the source — it's ~300 lines.
- Cursor transcript format (stored in SQLite, not JSONL — needs a different approach; not shipped yet because it can't be verified against a real installation without one on hand, and a security tool that silently finds nothing is worse than one that's honest about not supporting a platform yet)
--redact-in-placeto scrub findings from transcripts directly- Team/CI dashboard for aggregating findings across a fleet of developer machines (paid tier)
Need something like this built for your own codebase/workflow? I take on paid automation work — same process, real proof of work.
agent-audit is free and MIT-licensed, no strings attached. If it caught something useful in your logs and
you'd like to support continued development (Cursor support, the redact-in-place flag, more patterns), tips
are welcome via USDC/ETH on Base, Ethereum, Polygon, Arbitrum, or Optimism (same address on all):
0x36CCCB5854e1d513A2Af94CeaFC0f886102634e2
MIT