# Skarn

> Skarn is an AI coding session security scanner. It reads the local session logs that AI coding
> assistants already write to disk and surfaces leaked credentials and the attacks that exploit
> them. It runs entirely on the local machine - no upload, no network call by default, and nothing leaves the machine.

## What it is
- A security scanner for the AI coding-assistant session logs on a developer's machine.
- Covers 13 assistants: Claude Code, Gemini CLI, Antigravity, Codex CLI, Cursor, GitHub Copilot, Kimi Code CLI, Grok Build, Grok Bot, OpenCode, Cline, Cowork, Claude Enterprise.
- A single static binary. Scans locally; makes zero network calls by default.
- Built for regulated, audit-heavy, EU data-residency environments where nothing may leave the machine.

## What it detects
- Leaked credentials pasted into AI sessions: AWS keys, database URIs, API tokens, and 30+ AI provider key formats (OpenAI, Anthropic, AWS Bedrock, Gemini, Cursor, NVIDIA, OpenRouter, and more),
  across 251 detection rules (155 community secret patterns + 96 AI-specific detectors).
- Every secret is shown redacted.
- Prompt-injection-to-exfiltration attack chains, correlated across MITRE ATLAS tactic-aligned stages.
- Every finding is crosswalked against MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, and CWE,
  emitted as SARIF 2.1.0 taxonomies and mirrored to result tags for GitHub code scanning.
- A per-session and per-team risk score (0-100) for dashboards and CI gating.
- A real-time pre-execution guard hook for Claude Code, Gemini CLI, Antigravity, Codex CLI, Cursor, GitHub Copilot, Kimi Code CLI, Grok Build, Cline (GitHub Copilot covers both the CLI and VS Code agent mode) - on macOS, Linux, Windows, and in Docker - that can refuse a leaked credential before the tool call runs.
- The guard gates more than tool calls. On Claude Code it also gates the submitted prompt, the text a slash or custom command EXPANDS into (content the prompt-submit hook never sees), the task or subagent a session is about to SPAWN, and - opt-in - the OUTPUT of a tool call or of a resolved parallel batch, before the model sees it. A secret heading into any of those channels is exfiltration, and the guard blocks it before it leaves the machine.
- Not every host gives the guard a way to block. Where a host exposes only an observation channel the guard still runs, detects, and writes its audit log without deciding: a turn-end advisory on OpenAI Codex that surfaces recent-session exposures, and detection-and-audit-only handling of GitHub Copilot CLI's transformed-prompt event (opt-in), which Skarn observes rather than rewrites. `skarn guard report` then separates real blocks from would-be blocks and from detect-only findings on events a host cannot act on, so an audit-to-enforce decision rests on honest counts.
- Every hook event, per host - what it scans, how it blocks, and whether it is wired by default - is documented at https://getskarn.com/manual/guard-events/
- Beyond the session logs, `skarn vet` statically vets the local AI assistant configuration itself - the hooks, MCP servers, permission grants, plugins, and skills the assistants load - for risky patterns, across Claude Code, Gemini CLI, Codex CLI, Cursor, GitHub Copilot, Grok Build, Grok Bot, Microsoft Scout. It is a separate read-only, offline pass and needs no license.
- `skarn mcp` runs a local stdio MCP server on the same binary, so an AI coding assistant can ask Skarn directly: a redacted scan, the config vetting, and session metadata, all read-only, with no write tool and no network. Two opt-in content tools (`--enable-recall`) search and read past sessions through the same redactor, so a masked secret can never be searched for. The MCP Registry entry is com.getskarn/skarn; the launcher is `npx @skarn-security/skarn mcp`.

## How it differs from traditional secret scanners
- Traditional secret scanners scan git repositories. Skarn scans the AI session logs those scanners
  never look at. A key pasted into a chat and never committed is invisible to them and obvious to
  Skarn. Different surface, different class of attack.

## What it does not do
- It surfaces findings (awareness and understanding); it does not prescribe or apply fixes. The
  team owns the response.

## How to install it
- macOS and Linux: `brew install skarn-security/tap/skarn` from the public tap. No account, no token, no SSH key. Use the fully-qualified name: since Homebrew 6.0 a non-official tap must be trusted, and installing by the full name trusts that one formula, so it stays a single command.
- Any platform: download the single static binary for macOS, Linux, or Windows (x86_64 or ARM64) from the public GitHub releases at https://github.com/skarn-security/skarn-dist/releases/latest and put it on PATH. The Windows binaries are Authenticode-signed under Skarn Software OÜ.
- Containers and CI: `docker pull ghcr.io/skarn-security/skarn:0.33.0` (public, multi-arch, distroless, cosign-signed with an SPDX SBOM and SLSA provenance per architecture).
- First run: `skarn assess` scans every AI coding session on the machine with no configuration and prints a redacted risk summary. With nothing installed, `npx @skarn-security/skarn@0.33.0 assess` runs the same scan: https://getskarn.com/assess/
- On first run Skarn shows its end-user license agreement and asks you to accept it before the command proceeds; `skarn eula accept` records acceptance for non-interactive use.
- Full instructions, per-platform assets, and the cosign verification command: https://getskarn.com/install/

## How to wire the guard
- skarn setup wires the guard hook into the installed agents it supports (Claude Code, Cursor, Codex CLI, Copilot CLI, Gemini CLI, Grok Build) in audit mode and ends with a self-test.
- skarn doctor confirms the wiring and names the command that clears a warning or failure wherever one exists.
- skarn guard report summarizes the guard's own audit log: once the calls it flagged span five or more days with no deny among them it prints the exact command that switches those hooks to enforce, and its forecast counts the blocks and prompts per day that enforcing would have produced, over the calls the guard flagged rather than over all traffic.
- Plugin route for Claude Code, Codex CLI, Gemini CLI and Antigravity, and Cursor's own plugin repository: https://getskarn.com/install/#guard

## Guides
- Where AI coding assistants store your prompts on disk: the exact path, file format, and relocation environment variable for every assistant Skarn reads, verified against each vendor's own source and re-checked on a schedule. Answers "do AI coding assistants store my prompts and secrets on disk" with the paths rather than a yes. https://getskarn.com/guides/where-ai-assistants-store-sessions/
- How to scan AI coding assistant sessions for leaked secrets: the audit workflow over those local stores, and what a session scan catches that a git secret scanner cannot. https://getskarn.com/guides/scan-ai-coding-sessions-for-secrets/
- What is an AI coding session security scanner: the category definition, and how it differs from git secret scanners, endpoint DLP, and inline AI gateways. https://getskarn.com/guides/what-is-an-ai-session-security-scanner/
- Shadow AI data loss prevention for developers: why what developers paste into AI assistants sits outside endpoint and network DLP. https://getskarn.com/guides/shadow-ai-dlp/

## Original research
- Skarn publishes its measurements with the method, the corpus, and the known gaps. Every figure below is the output of a command over a labeled corpus.
- What leaks into AI coding sessions (measured 2026-07-12 with skarn 0.17.0): a teardown of a labeled corpus of 62 AI coding sessions across all five assistants - 130 credential and attack incidents (33 critical, 86 high, 11 medium) from 198 rule matches, 42 distinct secret and attack classes, and 11 multi-stage attack chains, one of which correlates the same secret across two different assistants a day apart. 40 of the 130 incidents exist because a file was read into, or echoed back through, the transcript. The corpus is entirely SYNTHETIC and no real developer sessions, accounts, or third-party data were scanned, so this is an anatomy of what these tools persist to disk, not an estimate of how often it happens in the wild. https://getskarn.com/research/ai-session-secret-exposure/
- Secret-detection precision (measured 2026-06-25): 0 false positives over 35 benign, credential-shaped decoys - a measured 0.0% false-positive rate - with 92 current credential formats across 57 services detected and the 10 formats not yet covered published as an explicit gap list. https://getskarn.com/research/secret-detection-precision/
- Attack-chain detection precision (measured 2026-06-25): 0 false chains over 49 benign, chain-shaped agent sessions, with 16 real-incident attacks all detected and correlated into critical chains. https://getskarn.com/research/attack-chain-detection-precision/

## Blog
- Grok Bot session scanning (2026-08-28): Grok Bot, xAI's persistent desktop agent (beta since 2026-08-11), keeps a cleartext chat-transcript replica on the local machine, and its catalog GitHub connector asks for a personal access token typed into chat while its own docs say to use the secret card. Skarn reads that local store since 0.25.0, redacted and offline, the same way it reads the other assistants; no incumbent endpoint tool documents coverage of it. https://getskarn.com/blog/grok-bot-session-scanning/
- The leak is in the connector setup (2026-08-28): a plaintext token in an MCP config file (mcp.json, settings.json) is an earlier leak than a pasted secret, gitignored and outside git scanners; GitGuardian counted 24,008 secrets in public MCP configs (2,117 valid) and Token Security found 20% of Claude Code or Cursor endpoints carry hardcoded MCP secrets. `skarn vet` checks the setup around those tokens locally and offline with no license required, including a Grok Bot credential store whose mode grants group or other read. https://getskarn.com/blog/skarn-vet-mcp-config-leaks/

## Editions and pricing model
- The free tier is the full local product under a license anyone can register for, an individual or an organization alike: the entire detection engine, all recall commands, the localhost web UI, every output format (text, JSON, SARIF, NDJSON), redaction, CI gating, a personal baseline file, custom rules, and the guard in audit mode. The binary is publicly downloadable with no account: `brew install skarn-security/tap/skarn`, a single static binary from https://github.com/skarn-security/skarn-dist/releases/latest (macOS, Linux, Windows; Intel and ARM), or `docker pull ghcr.io/skarn-security/skarn`. `skarn check` needs a free license, issued at https://getskarn.com/free/ after a one-time email confirmation and verified offline; `skarn assess` and the recall commands need none.
- Paid tiers are licensed per developer: Pro adds the paid controls, Team the organization around them, and Enterprise fleet-scale reporting. Licenses are Ed25519-signed tokens verified locally against a key embedded in the binary - no activation, no callback, no kill switch. `skarn check` refuses with exit 7 when no license is installed and points to the free registration; a paid flag without a covering license refuses fail-closed (exit 5) before any scan; a lapsed paid license degrades to the registered free tier - it does not brick.
- Live demo: a 30-minute run of the scanner with you on a developer's machine; you watch it run and keep the redacted, risk-scored report. Booked at hello@getskarn.com.
- Pro edition: the paid controls for one developer - policy-as-code (--policy), baselines with per-entry provenance (--baseline directory union, --baseline-merge), the tamper-evident audit log (--audit-log), evidence packs (--format evidence), and guard enforce mode (real-time blocking). One named license, billed annually, at the same per-developer price as Team.
- Team edition: everything in Pro for each developer on the team, plus the organization - seats assigned and reclaimed in the customer portal, invitations, and a verified company domain whose developers join the organization themselves. Licensed per developer, billed annually, with a 2-developer minimum, bought from Skarn at hello@getskarn.com; above 24 developers Skarn licenses direct.
- Enterprise edition: the enterprise output profile (--profile enterprise, count-aware dedup and reshape for fleet-scale reporting) and a self-hosted fleet console over redacted findings and metadata (not raw secrets) with SSO, RBAC, and audit (roadmap). Licensed annually on an agreement, with an annual minimum; not self-serve - above 24 developers, or where procurement, a security review, or a purchase order is in the path, Skarn licenses direct at hello@getskarn.com.

## Output and integration
- Output formats: text, JSON, SARIF 2.1.0, and NDJSON (an ECS-shaped, one-finding-per-line SIEM event stream). CI gating via fail-on-severity / fail-on-risk.
- `skarn taxonomies` prints the pinned frameworks (MITRE ATLAS, OWASP LLM Top 10 2025, CWE) and the
  detector-to-crosswalk table.
- Runs on macOS, Windows, and Linux, on both x86_64 and ARM64. Single static binary, no runtime dependencies.

## Running in containers and CI
- Skarn is published as a multi-arch (linux/amd64 and arm64) container image. The real-time guard can be
  dropped into a containerized AI coding agent - Claude Code, OpenAI Codex (via Dockerfile.codex), GitHub Copilot CLI (via Dockerfile.copilot), Gemini CLI (via Dockerfile.gemini), or Antigravity CLI (via Dockerfile.antigravity) -
  as a build stage (COPY --from) so it inspects each tool call before it runs, even when the agent runs with
  permissions skipped; in CI, Skarn scans the mounted session store and gates on severity or risk score.
- The image is distroless, runs as non-root, and is cosign-signed (Sigstore keyless) with an SPDX SBOM and
  SLSA build provenance, verifiable with cosign verify. The image is public: a pull needs no login.
- See https://getskarn.com/for/containers/

## Command-line reference
- The full Skarn manual - every command, option, environment variable, exit status, and worked example - is at https://getskarn.com/manual/
- Commands:
  - `skarn check` - Scan AI sessions for leaked credentials and attack patterns.
  - `skarn assess` - Scan every AI session, print a redacted summary. Free, no license.
  - `skarn vet` - Vet the local AI config, read-only and offline. Free, no license.
  - `skarn mcp` - Local stdio MCP server: read-only, redacted scan and config tools.
  - `skarn baseline` - Triage into a baseline (audit); accept a false positive (accept).
  - `skarn search` - Search past AI sessions (literal text, or --regex).
  - `skarn recent` - List recent sessions.
  - `skarn restore` - Restore a session.
  - `skarn messages` - Show the messages of a session.
  - `skarn stats` - Session analytics: tokens, models, tools, and timing.
  - `skarn tools` - Show the tools used across sessions.
  - `skarn mcps` - Show the MCP calls made across sessions.
  - `skarn cmds` - Show the shell commands run across sessions.
  - `skarn export` - Export sessions as text, json, ndjson, html; secrets masked.
  - `skarn guard` - Pre-execution hook: read an event on stdin, emit a verdict.
  - `skarn setup` - Wire the guard hook into detected assistants, then self-test it.
  - `skarn doctor` - Check whether skarn is actually protecting this machine.
  - `skarn completion` - Print a completion script for bash, zsh, fish, or powershell.
  - `skarn serve` - Local web UI on 127.0.0.1, with every detected secret masked.
  - `skarn taxonomies` - Print the crosswalk plus Cyber Resilience Act process evidence.
  - `skarn license` - Show the active license, install one, or renew it.
  - `skarn eula` - Print the End User License Agreement, or record acceptance.
  - `skarn fleet` - Fold drops into the org aggregate; render the executive readout.

## Standards crosswalk
- Every finding is mapped against MITRE ATLAS v5.6.0, the OWASP Top 10 for LLM Applications 2025, and CWE,
  emitted as SARIF 2.1.0 taxonomies. The full detector-to-standards crosswalk table, the pinned
  framework versions, and the SARIF emission detail are at https://getskarn.com/standards/

## Contact
- Site: https://getskarn.com
- Email: hello@getskarn.com
- A 30-minute live demo can be booked at hello@getskarn.com.