Find out what an AI agent can take from your machine.

A free script that looks at your machine the way a malicious npm package or a hijacked MCP server would: keys, tokens, secrets saved in your chats with coding agents. Then it tells you what to fix, in order.

~2 minfor a full run on a laptop with a large agent history
15modules, from SSH keys to MCP servers
0secret values in the report, fingerprints only

Run the audit Fix-it guide

Open source, MIT licence. Linux, macOS and WSL2. Code on GitHub.

~/.ai-agent-audit/audit-report.mdreal run

2/100 F · Pwned-Ready

69 distinct secrets · 15 modules · 2 min 17 s

2 critical
28 high
8 medium
2 low

Fix first

SSH private key has NO passphrase: ~/.ssh/id_ed25519_…critical · A.1
MCP server 'chrome-devtools' launched via npx without pinned versionhigh · M.2 · 11 servers
Claude Code sessions (last 90d): 38 file(s) contain 35 distinct classified secret(s)high · J.2

Excerpt from a report on a developer laptop used daily with Claude Code and Codex. Paths shortened.

Why

Nobody has to break in

Almost every finding only matters once foreign code runs on your machine. The catch: you run other people's code every day.

How foreign code gets onto your machine

npx without a version. An MCP server started as npx package@latest downloads the newest release every time your agent starts. If someone takes over the author's account, their code runs on your machine on the next start.
npm install. postinstall scripts in dependencies run on their own. That is how the s1ngularity and Shai-Hulud attacks worked.
A cloned repository. Hooks in .claude/settings.json or hidden instructions in CLAUDE.md take effect as soon as you open an agent in it.
A skill or an extension. A curl … | sh line in a skill nobody read before installing it.

What that code takes

SSH keys without a passphrase: instant access to your servers.
npm and GitHub tokens. With them it publishes infected packages in your name, so the attack spreads to others.
Secrets from agent chat history. API keys you once pasted into Claude Code or Codex sit in session files, in places every script knows.
Files like .env and MCP configs holding keys in plain text.

Example from August 2025: infected Nx packages (s1ngularity) used locally installed AI agents to collect 2,349 credentials from 1,079 machines.

What it checks

15 modules, one question each

Every finding says why it matters and gives one concrete fix.

Keys and tokens: SSH keys without a passphrase, cloud access (AWS, GCP, Azure, Kubernetes), npm, PyPI, GitHub and GitLab tokens, .env, .netrc and .pgpass files.
Agent history and sessions: Secrets in shell history and in Claude Code, Codex, Gemini CLI, Cursor, Aider and Cline transcripts. Each one named by service, with a pointer to where you rotate it.
MCP servers: Every server in every config: how it starts (npx pinned or not, uvx, docker, remote) and whether it keeps keys in plain text.
Agent settings: Skip-permission modes, aliases like --dangerously-skip-permissions, hooks, a custom ANTHROPIC_BASE_URL.
Repositories: Hooks and permissions in .claude/ and .cursor/, instructions hidden in CLAUDE.md and AGENTS.md, invisible characters.
Skills: Recently installed skills, curl | sh commands, instructions like “don't tell the user”.
Known attacks: Package versions from confirmed attacks (Nx, axios, @bitwarden/cli), Shai-Hulud traces in node_modules and on your GitHub account.
System: docker group, passwordless sudo, firewall, backups, isolation, an unlocked password manager. On macOS also TCC permissions, LaunchAgents and Time Machine encryption.

Run it

Three commands, nothing to install

No dependencies to add. You need bash 4.4 or newer; on macOS: brew install bash. jq makes some checks faster and more precise, but is optional.

The HTML report opens in your browser on its own. action-plan.md sorts the work into today, this week and this month.

Download

$ git clone https://github.com/bartek-filipiuk/ai-agent-audit.git

Run

$ bash ai-agent-audit/scripts/run-audit.sh

on macOS:

$ "$(brew --prefix)/bin/bash" ai-agent-audit/scripts/run-audit.sh

Start with the action plan
```
$ less ~/.ai-agent-audit/action-plan.md
```

Prefer an agent?

Install it as a skill and ask Claude Code to walk you through the result:

$ git clone https://github.com/bartek-filipiuk/ai-agent-audit.git ~/.claude/skills/ai-agent-audit

> Run the ai-agent-audit skill, then walk me through the action plan from the top, one item at a time.

Your data

What the script does with what it finds

Read-only. It writes only to ~/.ai-agent-audit/ (or the --output directory), readable by you alone.
Stores no secrets. The report holds paths, types and fingerprints like ghp_****wxyz (40 chars): enough to find the key in your provider's panel, not enough to use it.
Sends nothing to the author. No telemetry, no analytics. The only network calls come from your own gh and npm, if logged in: they ask GitHub and npm about your token scopes and your repository list.
Fixes nothing by itself. You make every change. The exception is the separate purge-secrets.sh, which redacts secrets in your history; without --purge it only shows what it would do.
You can read it. About 4,700 lines of bash in one repository. Read it before you run it, like any code from the internet, or hand it to your agent to read.

What it does not do

It does not check whether a key still works. It never contacts providers, so treat every key it finds as live.
It gets things wrong. Example tokens from docs and tests match the patterns too. The fingerprint helps: ghp_****1234 is probably a dummy.
It only looks at this machine. Servers and CI need their own check.
It only knows documented attacks. The list of infected versions is updated by hand. New ones go out on the mailing list.
It scores harshly. Every unpinned MCP server counts separately, so a single-digit score on the first run is common. The action plan matters, not the number.

Guide and alerts

What to do with the result

Leave your email and you get:

Right after you confirm: the “Fixing what the audit found” guide. Eight steps, most important first, each with the command, how to check it worked, and the trap that is easy to fall into. Most take a few minutes.
After that, only when something breaks: a short email about a new supply-chain attack (an npm worm, a hijacked MCP server, an infected extension) with one command that tells you whether it affects you.
Nothing else. No weekly newsletter. Unsubscribe with one click.

FAQ

Is it safe to run?

The script only reads files and writes a report to one directory. It downloads nothing while it runs. Read the code on GitHub first, or ask your agent to.

How long does it take?

On the author's laptop, with a few hundred megabytes of saved agent sessions: 2 minutes 17 seconds. Searching chat history takes longest. Run single modules with --modules, for example --modules M for MCP servers only.

Does it work on Windows?

Through WSL2, as Linux. Native Windows is not supported.

My score is in single digits. Is it that bad?

The score is harsh on purpose: every unpinned MCP server and every file with a secret costs points separately. Look at action-plan.md, not the number. The first few steps (a passphrase on your SSH key, pinned MCP versions, logging out of npm) usually remove most of the risk.

It found my key in chat history. Now what?

Rotate the key with the provider first; the report says where. Only then clean the history with purge-secrets.sh. The order matters: a redacted key that is still valid keeps working for anyone who copied it before.

How is this different from security-audit.dev?

security-audit.dev checks your application's code. ai-agent-audit checks the machine you write that code on. Both are free and open source.

How can I help?

Report a false alarm or something the script missed as a GitHub issue. Report a weakness in the tool itself privately, as described in SECURITY.md.

Can I use it at work and for clients?

Yes. MIT licence: use it, change it, extend it, commercially too.