Watch everything.
Your developers paste secrets into AI assistants every day, and nobody can see it.
Skarn reads the session logs your AI coding assistants already write, and surfaces the leaked credentials and the attacks that exploit them. It runs entirely on the local machine - no upload, no network call by default, nothing leaves it.
Skarn is the local-first, no-egress forensic layer for the AI-session surface the inline and cloud tools disclaim: local-disk session content, MCP and tool-call detail, and post-hoc attack-chain reconstruction with a session risk score.
Nothing leaves the machine. The free tier is the full local scanner; the paid tiers add the org controls. Built for regulated, audit-heavy, EU data-residency environments.
Not an engineer? Find your view.
What matters to you is not what matters to them. See what Skarn means for your role - the business risk, the security posture, the compliance position, or the developer view.
The surface nobody is watching.
Every AI coding assistant - Claude Code, Cursor, Gemini, Codex, GitHub Copilot - writes the whole conversation to disk: every prompt, every file it read, every command it ran, in plaintext. Developers paste keys, passwords, and .env files into those sessions all day long. Secret scanners look at your git repositories. None of them look at the session logs.
Live credentials, in the open
A pasted key now sits in plaintext in a log file, in shell history, and in the provider's retention - valid, unrotated, and outside every control you have.
Silent and undetected
A leak to git gets caught and rotated. A leak into an AI session gets caught by nothing, and stays valid indefinitely while no one knows.
A new class of attack
Poisoned content can steer an assistant into reading a secret and shipping it out. "We don't train on your data" does nothing to stop it.
What your engineers leaked, made visible.
Point Skarn at a developer's machine and it reads the AI session logs already on disk - across every assistant - and shows you the live credentials and the attacks around them. Redacted, scored, and attributed to the exact session. In minutes, on the machine, nothing uploaded.
Every credential, redacted
248 detection rules - 155 community secret patterns plus 93 AI-specific - pulled straight out of past AI sessions: AWS keys, database URIs, and every major AI provider key (OpenAI, Anthropic, Bedrock, Cursor, and 30+ more), each shown masked, not in full.
The attack, not just the key
The prompt-injection-to-exfiltration attack chain an ordinary secret scanner can't see: poisoned content driving a read, then a leak.
A risk score you can act on
One number per session and per team for a dashboard or a CI gate - so exposure is something you measure and drive down, not guess at.
Why Skarn is different.
Reads AI sessions, not git
A surface your git secret scanners never look at. The key pasted into a chat and never committed is invisible to them and obvious to Skarn.
Shows the attack, not just the secret
Credential read, prompt injection, and exfiltration, linked into an attack chain correlated across MITRE ATLAS tactic-aligned stages.
Local-only, no egress
No upload, no network call by default, no telemetry. The session logs do not leave the machine - the sentence that gets it past EU legal.
One binary, every assistant
Claude Code, Cursor, Gemini, Codex, Copilot Chat - one vendor-neutral control across every tool your team uses. It scans in milliseconds.
Real-time guard
Wired as a pre-execution hook in Claude Code, Cursor, Codex CLI, and GitHub Copilot, it refuses a malicious tool call - a hardcoded credential, a typosquatted package - before it runs. The same binary, on macOS, Linux, Windows, and in Docker.
It surfaces, it doesn't prescribe
It tells you what leaked and where, redacted. Your team owns the response. Awareness and understanding, not a fix-it bot.
Mapped to the standards you track
Every finding is crosswalked against MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, and CWE, emitted as SARIF 2.1.0 taxonomies your SIEM, ASPM, and GitHub code scanning already speak. See the standards crosswalk.
From a free scanner to fleet-wide coverage.
The free tier includes the full local product under a license anyone can register for, run on your own machines - nothing leaves them. Paid tiers add the org capabilities: distributed policy and baselines, audit evidence, the maintained feed, enforcement, and central governance. And the scoped exposure assessment stays on offer as the fastest first look at what is already leaked.
Free
The full local product, under a registered license: the entire detection engine, session search and recall, the localhost web UI, every output format, redaction, and CI gating. Install it now - brew install skarn-security/tap/skarn, or a single binary for macOS, Windows, and Linux. Register the free license at getskarn.com/free; skarn assess scans with no license at all.
Team
The maintained subscription: the org controls - policy-as-code, org baselines, a tamper-evident audit log, guard enforcement - plus a signed feed of detection-rule and AI-attack updates verified locally that keeps detection current between binary releases.
Enterprise
The enterprise reporting profile and a self-hosted fleet console over redacted findings and metadata - not raw secrets - with SSO, RBAC, and audit (roadmap).
"Isn't this just a secret scanner?"
No. Traditional secret scanners scan your git repositories. Skarn scans the AI session logs your scanners never look at - the key an engineer pasted into a chat and never committed is invisible to them and obvious to Skarn. Different surface, different attacks: code written with AI assistance leaks secrets at roughly twice the rate of code written without it (3.2% vs 1.5% of commits, GitGuardian State of Secrets Sprawl 2026). The leak that gets you is the one nothing was watching.
Cloud secret-scanning platforms have started shipping endpoint agents that reach AI session files too - which confirms how real this surface is. Those agents inventory credentials into a vendor dashboard: an account to sign into, finding metadata leaving the machine, and a flat list of keys with no record of what the assistant actually did with them. Skarn is the other architecture: the scan is local, offline by default, and fails closed on a scan it cannot complete, and nothing leaves the machine - and it reconstructs the incident, not just the inventory. Credential read, injection, exfiltration, correlated into an attack chain and scored, in a redacted report that stays on the machine. The architecture comparison carries the dated, sourced detail.
Questions, answered.
How do I audit AI coding-assistant sessions for leaked credentials?
Run Skarn on the developer's machine. It reads the on-disk session logs that Claude Code, Gemini CLI, Codex CLI, Cursor, and GitHub Copilot already write, finds the leaked credentials and the attacks around them with 248 built-in rules, and produces a redacted, risk-scored report - locally, with no network call by default.
Can Skarn scan my Claude Code or Cursor history for secrets?
Yes. Skarn scans the local Claude Code, Gemini CLI, Codex CLI, Cursor, and GitHub Copilot session history for leaked API keys, tokens, and .env contents, shows each secret redacted, and uploads nothing.
Isn't this just a secret scanner?
No. Traditional secret scanners scan git repositories. Skarn scans the AI session logs those scanners never look at - the key an engineer pasted into a chat and never committed is invisible to them and obvious to Skarn. Different surface, different class of attack.
What about the endpoint agents from cloud secret-scanning platforms?
Some cloud platforms now ship endpoint agents that scan AI session files for credentials. They are built around the vendor's dashboard: an account and workspace to enroll in, finding metadata sent upstream, and a credential inventory as the output. Skarn scans locally with no vendor dashboard, works fully offline, fails closed on a scan it cannot complete, and reads the whole session - so the output is what happened (the attack chain, the risk score, the audit-ready report), not only which keys exist. Different architecture, different question answered.
Does any data leave the machine?
No. The scan runs entirely on the local machine - no upload, no telemetry, and no network call by default, so the session logs never leave the laptop. `skarn assess` needs no account; `skarn check` needs a free license, and it is verified offline, so nothing leaves the machine even then. The only optional egress is the Team maintained-feed fetch of signed rule updates; no secret ever leaves the machine.
Which AI assistants does it cover?
Five: Claude Code, Gemini CLI, Codex CLI, Cursor, and GitHub Copilot - one vendor-neutral control across every tool your team uses, from a single binary.
Who is Skarn for?
Security leads and engineering managers in regulated, audit-heavy, or EU data-residency environments who need to see what their developers have leaked into AI tools - without sending anything to a vendor.
Is it open source? What does it cost?
Skarn is closed source, with a free tier that includes the full local product under a license anyone can register for, an individual or an organization alike. Paid Team and Enterprise tiers add the org capabilities - the maintained detection feed, policy-as-code, org baselines, audit evidence, real-time enforcement, and the fleet console. Contact [email protected].
See your own exposure in 30 minutes.
A scoped, consent-first assessment, run with you on a developer's machine. Nothing leaves the laptop - you watch it run and keep the redacted report. Start with a one-time audit; turn on continuous monitoring and team reports once you see what is there. It is the fastest way to find out what your engineers have already leaked into AI tools.
Built by an experienced security and engineering team. Runs on macOS, Windows, and Linux, on both Intel and ARM.