ranwhat watch
Reads what your agents already ran and raises the handful of irreversible actions worth knowing about.
Flight recorder for AI agents
Find out what your agents actually did.
Your coding agent has your shell, your keys and your repo. ranwhat reads what it ran, surfaces the handful of actions worth knowing about, and never sends a byte anywhere.
$
ranwhat watch --days 30
Install
1 critical 4 high * Credential material accessed 18:13 Bash cat ~/.ssh/id_rsa -> Whatever it read is now in a model context you do not control. * Bulk or recursive deletion 15:13 Bash rm -rf .frames ; printf 'node_mod… * Package published 14:58 Bash npm publish --access public ──────────────────────────────────────── Read locally. Nothing was transmitted.
01 / Commands
What it did, what leaked, what it may do next.
Each one runs locally and reports before it changes anything.
ranwhat clean
Finds credentials sitting in plaintext in your agent transcripts, tells you what to rotate, and masks them.
ranwhat scan
Scores the authority your agent's credentials carry, and which permissions it has never once used.
02 / Install
Thirty seconds, no signup.
Python 3.9 or newer. No dependencies. Point it at your own machine and see what the last month looked like.
$
uvx --from git+https://github.com/MatijaMiki/ranwhat ranwhat watch
Prefer it on your path? pipx install git+https://github.com/MatijaMiki/ranwhat
Installing with plain pip instead? Upgrade it first, because
the pip macOS ships is too old to read this project's metadata.
03 / Questions
The ones worth answering up front.
Does it send anything anywhere?
No. The watcher reads transcripts your agents already wrote to disk and prints to your terminal. The scanner talks only to the credential's own issuer when you ask it to introspect a token. There is no telemetry, no account and no server.
Does it need my credentials?
The watcher needs none at all. Point it at your machine and it works. The authority scanner can introspect tokens read-only, but it never exercises a permission and never needs a write-scoped credential. Pass tokens through the environment rather than the command line, because anything in argv is readable by every user on the machine.
Which agents does it read?
Claude Code and OpenClaw today. Codex and an OTLP receiver are next, which will cover anything emitting OpenTelemetry GenAI spans. It reads files the agent already wrote, so there is no wrapper, no proxy and nothing in your critical path.
Will it slow my agent down?
No. It runs after the fact against files on disk. Your agent never knows it exists.
Is it safe to run clean --apply?
It reports by default and changes nothing until you ask. When you do, it writes a timestamped backup first, then parses the rewritten file back before replacing the original, so a transcript is never left corrupted. Ordinary config, templates and placeholders are left alone.
If I mask a secret, is it safe now?
No, and the tool says so. The value was already written to disk in plaintext and already sat in a model context you do not control. Masking stops it leaking a second time. Rotating it is the actual fix, which is why the report leads with what to rotate and where.
How is this different from scanning my agent's config?
Tools that scan agent components look for known-bad content in what is installed: MCP servers, skills, configuration. ranwhat looks at what your agent actually did with the access it has, and what it is still allowed to do next time.
What does it cost?
Nothing on your own machine, forever, and the code is MIT licensed with no dependencies. Paid tiers exist for collecting records across machines and for evidence retention. We never charge per finding, because a tool paid by the alert has a reason to cry wolf.
Does it work on Linux and Windows?
Linux yes. Windows is untested. It is pure Python with no platform-specific calls, so it will probably work, but nobody has verified it. Tell us if you do.
04 / Follow
Built in the open.
New sources and rules ship regularly, and the commit history carries the reasoning, including the things the tool got wrong and what changed because of it.