Check your agent config before you commit it.
Drop a .claude, .cursor or .codex settings file. We look for secrets and always-approved commands. Nothing is uploaded: this page cannot make network requests.
Free version: one file at a time, up to 1 MB. Zip scans need the full version.
Free and full version
Free
- One file at a time.
- Pass or fail.
- The first 3 findings by severity, and a count of the rest.
Full version
- Scan a zip of a repo's agent folders: .claude, .cursor, .codex, CLAUDE.md, AGENTS.md, .mcp.json and .gitignore.
- Every finding, with fix steps.
- Download report.md, with secrets masked.
- Unlimited scans in this browser.
Unlock the full version: coming soon
The full version is unlocked in this browser.
The paid full version is coming soon. When it is available, payment will be handled by Stripe on its own page, and you will return to a confirmation page that unlocks this browser.
What it checks
- Secret formats in any text file: AWS access keys, GitHub tokens, Stripe live keys, Anthropic and OpenAI keys, Slack tokens and private key blocks.
- Long random-looking values under keys named like token, secret, password, API key or auth, in JSON and TOML.
- Literal secrets in MCP server env blocks (.mcp.json, .cursor/mcp.json).
- Claude Code permissions: bypassPermissions mode, allowing all of Bash, pre-approved risky commands, and unrestricted WebFetch.
- Codex approval_policy and sandbox_mode in .codex/config.toml.
- Instructions in CLAUDE.md, AGENTS.md or Cursor rules telling the agent not to ask for permission.
- Full version, zip only: .claude/settings.local.json or .env files in agent folders that no .gitignore covers.
Cursor auto-run settings are not checked yet, because their current names have not been confirmed from Cursor's documentation.
Your file is read by JavaScript in this tab and never sent anywhere. Findings show secrets masked, for example the first 4 and last 2 characters with asterisks between.