ranwhat

A flight recorder for AI agents, and a scanner for the authority they hold. AI coding agent security for Claude Code and twenty-nine other coding agents, run on your own machine. No account, no telemetry, no dependencies.

Website and docs: https://ranwhat.com

Your coding agent has your shell, your keys and your repo. ranwhat reads what it actually ran and surfaces the handful of irreversible actions worth knowing about.

$ ranwhat watch --days 90

  ranwhat watch  · local agent flight recorder
  ----------------------------------------------------------------------------
  Read Claude Code: 4 transcripts, last 90 days

  2 critical  2 high

  * Credential material accessed   2026-09-30 18:13:00  Bash  9c41e07b2d5a8f13
      cat ~/.ssh/id_rsa
      -> The agent read a file whose only purpose is to hold secrets. Whatever
         it read is now in a model context you do not control.

  * Bulk or recursive deletion   2026-09-28 14:42:00  Bash  51e3c6a43e946bf5
      …rm -rf '@'
      -> Recursive deletion. Recoverable only if something else was backing it
         up.

  * Package or release published   2026-09-21 11:05:00  Bash  3fa9c2d81b7e4a06
      npm publish
      -> Something was pushed to a registry other people may install from.
         Supply-chain reach, and usually irreversible.

  * Destructive git operation   2026-09-15 17:30:00  Bash  e181acd29cf199ab
      git push --force origin main
      -> History rewriting or branch deletion. This is the class of action
         that destroys the record of what else happened.

  ----------------------------------------------------------------------------
  Read locally. Nothing was transmitted.

Claude Code deletes the transcript of a session you have not used for longer than cleanupPeriodDays, 30 days by default. So --days 90 finds more if you raised it, if a session you resumed within that period has older actions in it, or for sessions started or last continued in Claude Desktop or Cowork, which Claude Code v2.1.248 and later keep at any age by default.

Install

Run it once, without installing anything:

uvx ranwhat check

Or put it on your path:

pipx install ranwhat
pip install ranwhat

Then ranwhat demo shows an authority scan on a bundled example.

As a Claude Code plugin

/plugin marketplace add MatijaMiki/ranwhat
/plugin install ranwhat --marketplace MatijaMiki/ranwhat

That adds /ranwhat:check, /ranwhat:watch, /ranwhat:reach and /ranwhat:guard, and a skill that tells Claude when to use them. The plugin installs no hook: the guard stays off until you ask for it with /ranwhat:guard. It runs the same uvx ranwhat commands, so it needs uv on your path.

Python 3.9+. No dependencies, and nothing is built on your machine.

Commands

ranwhat check: everything worth knowing, in one read-only pass

Runs watch and clean together and changes nothing. Its last lines suggest reach for the MCP servers and credential files your agents can reach.

check, watch and clean exit with status 0 when they ran, 1 on an error, and 2 when they found no agent history to read (argparse's usage errors are 2 as well), so a script can tell a machine with nothing on it from a clean one. With --fail-on SEVERITY they exit 3 when anything at or above medium, high or critical is found: every action watch rates that high or higher, and every secret clean finds, each of which is critical. A secret masked with --apply still counts: it has to be rotated. An error (1) or nothing read (2) wins over 3.

ranwhat check --fail-on high --sarif ranwhat.sarif

--sarif PATH also writes what was found as SARIF 2.1.0, for code scanning: one result for each rule an action tripped, and one for each secret. A secret is in it as the report shows it, masked (sk_…dc 32 chars), never its value or its fingerprint, and every value clean finds is masked wherever else it shows up there, as in the report. Agent history lives outside your repository, so each result points at the transcript or project directory it came from on the machine that ran it. An action's results carry its id (actionId), and fingerprints made from it, so code scanning can follow a finding from one run to the next.

On a terminal, check, watch and clean keep one status line on stderr while they read, counting transcripts through each pass: indexing secrets ((first run) the first time), checking actions, looking for secrets. Nothing is written there when stderr is not a terminal, or with --json.

ranwhat watch: audit what Claude Code and your other agents ran

Reads what Claude Code and your other coding agents already wrote to disk. No wrapper, no proxy, nothing in your critical path unless you install the hook. Every agent below is read by default, each from where it keeps its history (the variable in brackets moves it, as it moves the agent itself); one that is not on your machine is skipped.