ranwhat

Your coding agent has your shell, your keys and your repo. ranwhat shows what it did with them.

It is an open-source, MIT-licensed command-line tool that reads the history AI coding agents already write to disk: Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Qwen Code, Grok Build, Droid, Kimi, Pi, Muse Code and OpenClaw. It works after the fact, so there is no proxy, no wrapper and nothing in your agent's path.

• watch flags the handful of actions worth knowing about: credential files read, recursive deletes, force pushes, packages published.
• clean finds API keys and passwords left in transcripts, tells you what to rotate, and can mask them, with a backup first.
• scan scores what an agent's tokens may do across 12 providers, including GitHub, AWS, Google, Slack and Stripe.

It runs locally, with no account, no telemetry and no dependencies. A free run is one command: uvx ranwhat check