skarn(1)
AI coding session security scanner with built-in session search
skarn 0.19.0
Real-time guard: every hook event it gates, per host, is documented in the guard hook-event reference.
Synopsis
skarn check [options] skarn assess [options] skarn vet [options] skarn baseline <audit|accept> <file> [<fingerprint>] [options] skarn search <query> [options] skarn recent [options] skarn restore <session> skarn messages <session> [options] skarn stats [options] skarn tools [options] skarn mcps [options] skarn cmds [options] skarn export [options] skarn guard [report|accept <fingerprint>] [options] skarn setup [options] skarn doctor [options] skarn completion <shell> skarn serve [options] skarn taxonomies skarn license [<file>|-|renew] [options] skarn eula [accept] skarn --version skarn --help
Description
Skarn is an AI coding session security scanner with built-in session search. It detects leaked credentials and the attack patterns that cause or exploit them in the local session transcripts of AI coding assistants (Claude Code, Gemini CLI, Codex CLI, Cursor, and VS Code Copilot Chat), and it lets you search, browse, and analyze those sessions.
Skarn is a single static binary. It scans locally and makes no network connection by default; the only features that transmit data off the machine are opt-in and named explicitly in the SECURITY section below.
Skarn has two faces over one parsing engine. The recall commands (search, recent, stats, and friends) are the daily-use surface and never trigger a scan. The check command is the security scanner: it runs the detection rules, correlates attack chains, and computes a session risk score for CI/CD gating. Every finding is mapped to MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, and CWE; run skarn taxonomies to print the crosswalk and the pinned framework versions.
Commands
check [options]- Scan AI sessions for leaked credentials and attack patterns.
assess [options]- Scan every AI session on this machine and print a friendly risk summary, with an optional shareable redacted report. Free, no config, no license.
vet [options]- Statically vet the local AI assistant configuration (hooks, MCP servers, permission grants, plugins and skills) for risky patterns. Read-only and offline; free, no license.
baseline <audit|accept> <file> [<fingerprint>] [options]- Interactively triage findings into a committed baseline (audit), or record a false-positive fingerprint (accept).
search <query> [options]- Search past AI sessions (literal text, or --regex).
recent [options]- List recent sessions.
restore <session>- Restore a session.
messages <session> [options]- Show the messages of a session.
stats [options]- Session analytics: tokens, models, tools, and timing (text, json, csv, or html).
tools [options]- Show the tools used across sessions.
mcps [options]- Show the MCP calls made across sessions.
cmds [options]- Show the shell commands run across sessions.
export [options]- Export sessions as text, json, ndjson, or html (redacted by default).
guard [report|accept <fingerprint>] [options]- Real-time pre-execution hook for editor/agent integration; reads an event on stdin and emits a verdict. guard report summarizes the audit log, forecasts what enforcing would cost, and prints the enforce flip when the window is clean; guard accept records a flagged finding as a false positive so the guard stops blocking it.
setup [options]- Wire the skarn guard hook into detected AI coding agents (merge-based, reversible), then verify it with the guard self-test.
doctor [options]- Check whether skarn is actually protecting this machine: binary, license, wired agent hooks, guard log, session stores, and the guard self-test.
completion <shell>- Print a shell completion script for bash, zsh, or fish.
serve [options]- Start the local web UI (search, recent, stats, and a redacted scan view) bound to 127.0.0.1.
taxonomies- Print the standards crosswalk (MITRE ATLAS, OWASP LLM Top 10, CWE).
license [<file>|-|renew] [options]- Show the active license, install one from a file (or stdin), or renew it from the license service.
eula [accept]- Print the Skarn End User License Agreement, or record acceptance of the current version (accept).
Options
Check options
Control the security scan: which rules run, the scan window, output format, and CI gating. check requires a license and refuses with exit 7 before any scan without a usable one; the free license is issued at https://getskarn.com/free after a quick email confirmation and is verified offline. Only --audit-verify is exempt: verifying an audit log's hash chain needs no license.
Assess options
The zero-config machine-scan wedge: scan every AI coding session on the machine and print a friendly risk summary, no flags and no license. -o writes a shareable redacted report (HTML or Markdown); --json emits the redacted scan for scripting. The scan is scoped by the same filters as check.
Vet options
Statically vet this machine's AI assistant configuration - hook commands, MCP server definitions, permission grants, and installed plugins and skills across Claude Code, Codex CLI, Cursor, Copilot, and Gemini CLI - and report the risky patterns it finds: hooks that exfiltrate local content or fetch-and-execute remote code, hooks that rewrite an assistant's own config, MCP endpoints on remote hosts, MCP launchers with no pinned version or digest, permission grants that approve a whole class of actions, and extensions installed from a remote source or carrying no integrity marker. Vet is read-only and offline: it opens each config file for reading, never writes one, and makes no network call. A config file that does not exist is skipped; a config file that exists but cannot be read is a coverage gap that fails closed under a --fail-on flag. Vet surfaces risky configuration and does not change it.
Baseline options
Interactive baseline triage. audit walks each new finding and records a true/false-positive decision with a reason into the committed baseline; accept records a single false-positive fingerprint non-interactively. The audit scan is scoped by the same filters as check. A false positive is suppressed on every later scan, while a finding labeled a true positive is recorded and keeps firing until the credential is rotated - the same labels the real-time guard honors. A finding that carries a secret is fingerprinted by that secret, so its acceptance follows the secret across sessions and machines; a finding with no secret (a behavioral finding such as prompt poisoning) is fingerprinted by the session it fired in, so accepting it silences that rule in that session only and the same rule in any other session keeps firing. To accept a finding the guard flagged, use `skarn guard accept <fingerprint>`: it takes the fingerprint straight from the guard's audit record and defaults to the personal baseline the guard reads.
Guard options
Control the real-time pre-execution hook used for editor/agent integration (Claude Code, Cursor, Codex CLI, and Copilot CLI). The report subverb reads the guard's own audit log instead of an event: it summarizes the flagged calls per agent (verdicts, top rules, latency, the most recent denies), states what enforcing that window would have cost (blocks per day, prompts per day), and, when the window spans at least five days with zero denies, prints the exact command that flips the wired hooks to enforce. The guard logs only flagged calls, so every count and every rate report prints is over flagged actions, never over all traffic. The accept subverb closes that loop: every audit record carries a fingerprint (the same secret-scoped key check writes to SARIF partialFingerprints), report prints it under each deny, and `skarn guard accept <fingerprint>` records it as a false positive so the identical call stops being flagged. Both subverbs are ungated: report reads nothing but the log, and accept writes only a file. On a flagged call the guard consults the personal accepted-findings baseline it shares with check (~/.config/skarn/baseline.json, the file form only - never the org-union directory, so the guard can never hit a paid gate): a finding accepted as a false positive is dropped from the verdict, while a finding a human confirmed as a REAL leak (`skarn baseline audit`, label true-positive) is never suppressed and keeps being blocked until the credential is rotated. Only the highest-severity finding of a call carries the fingerprint, so a call hiding several distinct secrets peels one accept at a time; a correlated attack chain still denies even when every secret in the call has been accepted; and a baseline that is missing, unreadable, or malformed suppresses nothing at all - a broken baseline means more blocking, never less.
Setup options
Guided onboarding: detect installed AI coding agents (Claude Code, Cursor, Codex CLI, Copilot CLI), merge the skarn guard hook into each one's native config in audit mode, and prove the wiring with the guard self-test. --scope project writes committed, shareable configs whose commands are portable by construction (a PATH-guarded invocation and a literal $HOME log path, never this machine's absolute paths); --plugin commits the claude plugin requirement instead of hook entries, and the two project routes are mutually exclusive - each removes the other's skarn-owned entries so the guard can never fire twice. Existing foreign hooks are never touched; every modified file is backed up first (*.skarn-bak.<timestamp>) and rewritten atomically; a target file that does not parse as JSON is refused, never overwritten. On a terminal it runs an interactive wizard with default-yes prompts; --yes accepts everything, --print writes nothing.
Doctor options
Health, wiring, and dead-hook detection. Doctor runs one named check per line - the binary and its path, the license, each detected agent's hook config, whether each wired hook command still resolves to an executable, whether the guard mode the hook asks for (audit or enforce) is what actually runs under this binary's license, whether the wiring matches what this version of skarn writes, the guard log's freshness, the session stores it can enumerate, the guard self-test, the cache directory, and how current the detection rules are - and every warning or failure names the exact command that clears it, or the resource that explains it when no single command applies (a free binary whose bundled rules have aged has no command to run, so that one check carries the editions link instead of a fix). Each agent's hook config is read as ordered precedence layers - the MDM/fleet-managed system paths first, then the repo's committed project config in the working directory (./.claude/settings.json, ./.cursor/hooks.json, ./.codex/hooks.json, ./.github/hooks/skarn.json), then the per-user config - so a machine wired only through the managed layer reports as protected and names the managed file, and a repo carrying a committed project config is inspected wherever doctor runs; on Claude and Codex a managed lockdown key (allowManagedHooksOnly / allow_managed_hooks_only) makes every lower layer inert, and doctor reports an inert user or project hook instead of counting it as protection (Cursor and Copilot layer additively, so every present layer runs). A committed project hook gets its own guard-command verdicts: an absolute machine-local path or an unrendered __SKARN_PATH__ placeholder FAILs (that file protects nobody but its author), a PATH-resolved command that does not resolve on this machine FAILs with the install command as the fix (the hook exits 0 here, so the repo is not protecting this machine), and Cursor at project scope WARNs naming the GUI-PATH gap - the deliberate, documented cost of a portable committed config. The license check WARNs when there is no license at all (check will not run, exit 7; assess, the guard, and the recall commands still work) and FAILs only when a license is present but broken. The eula check PASSes when an EULA acceptance is recorded (showing the accepted version, timestamp, and method) and WARNs when none is, with fix `skarn eula accept` - doctor itself never asks, so a diagnostic is never blocked by the acceptance gate. The guard-scope check WARNs when a hook wired with --guard-mode enforce runs on an unlicensed binary (the guard silently runs audit: it records the would-be verdict and blocks nothing). The guard-conformance check appears only when a managed layer declares a skarn hook and answers whether this machine runs what the org declared: it WARNs when the managed layer declares enforce on an unlicensed binary (the fleet is observing, not blocking), when the declared command does not resolve to an executable (the managed config alone deploys nothing - the binary must ride the same MDM payload), when a declared event is not gated, or when a hook disagrees with the declared mode; every branch is a WARN with an exact fix, never a FAIL, because a policy divergence is a fleet fact, not a broken install. Check ids (binary, license, eula, agent_config_<agent>, guard_command_<agent>, guard_scope_<agent>, config_drift_<agent>, guard_log_<agent>, self_test_<agent>, guard_conformance_<agent>, session_stores, cache_dir, rule_age) are a stable, greppable contract for fleet scripts. A failure exits 1; a warning never does; --json is a data mode and always exits 0. Doctor is hermetic: it makes no network call, shells out to nothing, and enumerates the session stores without reading a session's content. Set SKARN_MANAGED_ROOT to validate a staged managed payload before pushing it; the active root is echoed in the report header and in --json, so a staged report can never pass as a live one.
Serve options
Control the localhost web UI. Access requires the per-run token embedded in the URL the command prints at startup; opening that URL sets a session cookie, and scripts may pass it as a token= query parameter instead. The recall views (search, recent, stats) need no license; the security view (/api/scan) is the same engine as check and requires one the same way - without it the endpoint answers 403 and the Security tab shows how to register free. Opening a finding in the Security view shows a detail drawer (severity, taxonomy crosswalk, attack-chain context, and the redacted code context) from which you can accept the finding into your baseline as a false positive - the same write path as skarn baseline accept, recording only the finding's fingerprint, never its secret. The license is resolved once at startup, so installing one while the server is running needs a restart.
Global options
Available on a bare invocation.
Recent options
List and filter recent sessions.
Messages options
Show one session's messages. The session is a positional id or --session; the other flags only narrow which session a prefix resolves to.
Search options
Search past sessions. The query is positional and flag order is free.
Restore options
Restore a session by id.
Stats options
Session analytics. A positional session id switches to a per-session view.
Export options
Export session data.
Cmds options
Shell commands run across sessions.
Mcps options
MCP calls made across sessions.
Tools options
Tools used across sessions.
License options
Show the active license, install one, or renew it. With no argument it reports what license this machine is using, where it came from, and when it expires. With a file argument (or - to read stdin) it validates the license and installs it to the config directory, backing up any license already there. With renew it asks the license service for a fresh license for the current subscription, verifies the reply against the signing keys built into this binary BEFORE writing a single byte, and installs it; a reply that does not verify is discarded and nothing is written. Verification is not signature-only: the reply must carry the same license id and move the expiry forward, so a valid artifact belonging to another subscription is refused too. Renewal happens only when you type it - check, the recall verbs, serve, and guard never renew on their own - and it is the only network call skarn makes besides the opt-in maintained-feed fetch. The endpoint defaults to https://api.getskarn.com and is overridable with $SKARN_LICENSE_RENEW_URL; it must be https (plain http is accepted only against loopback), so a poisoned environment cannot send the license anywhere in cleartext. Renew exits 0 when the new license is installed, 1 when the service cannot be reached, 2 when the service declines (its reason is printed verbatim), and 3 when the reply fails verification. It never prints the license token itself, and it works without a license - and with an expired one - so it never exits 5.
Exit status
0- Clean, or informational output only.
1- A finding at or above the --fail-on-severity threshold was reported. For setup and guard --self-test: a target was refused or a verification failed. For doctor: at least one check FAILED (a warning never exits nonzero, and --json always exits 0). Also: the first-run EULA prompt was declined, so the invoked operation was not performed.
2- The session risk score exceeded the --fail-on-risk threshold. For setup: no terminal to prompt on and no --yes; the exact non-interactive command is printed.
3- A canary token was triggered (a proven breach). This overrides every other gate.
4- A policy precondition was not met: a required rule is missing, or the policy requires a baseline and none was supplied.
5- A requested paid feature is not covered by the active license (a Team or Enterprise flag without a matching license). Refused before any scan. With no usable license at all, check exits 7 before this gate is consulted.
6- The scan could not complete: session discovery or the scan itself failed. For vet: the home directory could not be resolved (so the configuration was never located at all), or a config file that exists could not be read, so the configuration was only partly seen. Fail-closed - the result is not trustworthy, so it is never reported as clean.
7- No usable license is present - none was found via SKARN_LICENSE, SKARN_LICENSE_FILE, or the installed file - so check refused before scanning. The free license is issued at https://getskarn.com/free after a quick email confirmation and is verified offline. Also used when a license IS present but cannot be used at all (revoked, tampered, or signed by an untrusted key). assess, the recall commands, guard, setup, doctor, vet, license, taxonomies and check --audit-verify never exit 7.
Environment
SKARN_SCAN_THREADS- Cap the worker-pool size for every parallel sweep (scan and recall). 1 forces a fully serial run. Default is one worker per core, capped at 32. Output is identical for any value; only latency changes.
SKARN_CLAUDE_DIRS- Colon-separated list of additional Claude Code config directories to scan beyond the default ~/.claude. Each entry is the dir that contains projects/. Roots are de-duplicated.
SKARN_TZ_OFFSET- Default timezone offset in hours applied when grouping recall and stats output by time.
SKARN_NO_TIMING- Suppress the dim "Scanned N sessions" timing line that recall commands print after a text run on a terminal. Already auto-suppressed for json/sarif/csv output and for non-TTY stdout.
SKARN_LICENSE_RENEW_URL- License-service endpoint `skarn license renew` posts to. Defaults to https://api.getskarn.com/v1/license/renew; set it to route renewals through an enterprise proxy. It must be https - plain http is accepted only against loopback - so a poisoned environment cannot redirect the license token to a cleartext endpoint. No other command reads it.
SKARN_GUARD_LOG- Path to append a redacted JSONL verdict log for guard (opt-in; off when unset). One record per flagged call, carrying the fingerprint that `skarn guard accept` takes; clean calls, and calls whose every finding was already accepted, are not logged.
SKARN_IDENTITY- Local-first identity tag (an SSO subject, email, or CI principal) stamped as provenance on baseline entries created with --baseline-create. Optional; Skarn never authenticates it.
SKARN_ORG- Local-first org or team tag stamped alongside SKARN_IDENTITY on baseline provenance. Optional.
SKARN_FEED_URL- Default feed channel URL used by check --update-rules when --feed-url is not given (Team).
SKARN_FEED_TOKEN- Credential presented to the subscriber feed channel when fetching a maintained feed (Team).
SKARN_EULA_ACCEPTED- Set to 1 to suppress the first-run EULA prompt and notice for this run without recording anything (ephemeral environments: containers, CI). Running Skarn constitutes acceptance either way; `skarn eula accept` records it durably instead.
SKARN_LICENSE- License token, resolved before SKARN_LICENSE_FILE and the config path.
SKARN_LICENSE_FILE- Path to a file containing a license token.
CLAUDE_CONFIG_DIR- A Claude Code config directory visible in Skarn's environment; folded into the claude source like an SKARN_CLAUDE_DIRS entry.
COPILOT_HOME- GitHub Copilot CLI config directory visible in Skarn's environment; replaces the default ~/.copilot as the Copilot CLI session root, folded into the copilot source.
SKARN_MANAGED_ROOT- Prefix doctor prepends to every managed (MDM/fleet) config path it reads, so a fleet admin can validate a staged payload directory before pushing it to a single machine (SKARN_MANAGED_ROOT=/tmp/stage skarn doctor). Empty or unset means the live system paths. Whenever it is active, doctor echoes the root in the report header and emits it as managed_root in --json, so a staged report can never pass as a report about the live machine. Only doctor reads it.
XDG_CACHE_HOME- Base directory for the rule and feed cache. Defaults to ~/.cache, so the cache lives in ~/.cache/skarn/.
Files
/Library/Application Support/ClaudeCode/managed-settings.json, /etc/claude-code/managed-settings.json, C:\Program Files\ClaudeCode\managed-settings.json- Claude Code's MDM-managed settings (macOS, Linux/WSL, Windows). Doctor reads the platform's path as the claude host's managed precedence layer; allowManagedHooksOnly: true there makes every lower layer inert. Read-only; never written.
/Library/Managed Preferences/com.anthropic.claudecode.plist- Claude Code's macOS managed-preferences domain. Declared as a managed source but not decoded; when present, doctor surfaces it as a coverage gap with a plutil command to inspect it, never as a silent absent.
/etc/codex/requirements.toml, %ProgramData%\OpenAI\Codex\requirements.toml- Codex's admin-managed requirements file (Unix, Windows). Doctor reads it as the codex host's managed precedence layer via a scoped reader (allow_managed_hooks_only and the [[hooks.<Event>.hooks]] command strings); allow_managed_hooks_only = true makes every lower layer inert. Read-only; never written.
/Library/Managed Preferences/com.openai.codex.plist- Codex's macOS managed-preferences domain. Doctor decodes the XML form (requirements_toml_base64 and config_toml_base64, base64 to the same scoped reader; the lockdown key is honored only from the requirements payload, matching Codex); a binary plist is surfaced as present-but-unreadable with the exact plutil conversion command, never as a silent absent.
/Library/Application Support/Cursor/hooks.json, /etc/cursor/hooks.json, C:\ProgramData\Cursor\hooks.json- Cursor's enterprise-managed hooks (macOS, Linux/WSL, Windows). Doctor reads the platform's path as the cursor host's managed precedence layer; Cursor layers additively (no lockdown key), so every present layer stays active. Read-only; never written.
/etc/github-copilot/policy.d/*.json, C:\ProgramData\GitHub\Copilot\policy.d\*.json- Copilot's managed policy directory (Linux/macOS, Windows). Doctor folds every *.json in the directory into the copilot host's managed precedence layer, sorted by name; Copilot layers additively. Read-only; never written.
./.claude/settings.local.json- Claude Code's personal, gitignored project settings file. Claude merges hooks across every settings file and runs all of them, so a guard wired here protects this checkout and doctor reads it as part of the project layer. skarn setup never writes it: it writes only the committed ./.claude/settings.json.
./.claude/settings.json, ./.cursor/hooks.json, ./.codex/hooks.json, ./.github/hooks/skarn.json- A repo's committed project-scope hook configs (claude, cursor, codex, copilot), written by skarn setup --scope project and read by doctor as each host's project precedence layer whenever it runs in that directory. Portable by construction: the committed command resolves skarn from PATH at run time and exits 0 where skarn is not installed.
~/.skarn.json- Optional tool configuration: the set of assistant tools and their session paths, plus an optional projects alias map. Both the recall surface and scan discovery (check, assess, baseline audit, the guard's session-end advisory, and serve's Security scan) read it, so the security scan and the recall views cover the same corpus. Falls back to a builtin tool set when absent. The projects object renames a resolved project for display: a key beginning ~, $, or / is a path prefix (with ~ and a leading $VAR expanded like sessions_path) matched against the canonical project root on whole path components, longest match winning (so /repo never matches /repository); any other key matches the derived display name case-insensitively; the value is the shown name. Aliases change display only, never the grouping key.
~/.cache/skarn/- Cache for downloaded rule and maintained-feed bundles. Honors $XDG_CACHE_HOME.
~/.config/skarn/baseline.json- The personal accepted-findings baseline, applied automatically when it exists: check, assess, and serve suppress its findings, and guard stops flagging them. Written by `skarn baseline audit/accept` and `skarn guard accept`. Honors $XDG_CONFIG_HOME. Holds fingerprints and hashes, never a raw secret; treat it as sensitive.
~/.config/skarn/eula-accepted.json- The EULA acceptance record: the agreement version accepted, an RFC-3339 timestamp, and the method (prompt, command, env, license-install). Written when acceptance is given at the first-run prompt, by `skarn eula accept`, or by installing a License Token; never transmitted. Honors $XDG_CONFIG_HOME.
~/.claude/- Default Claude Code session root. Scanned automatically; extend with $SKARN_CLAUDE_DIRS or $CLAUDE_CONFIG_DIR.
~/.claude/settings.json, ~/.claude/settings.local.json- Claude Code hooks and permission grants. Read (never written) by vet, and by the project-local ./.claude/settings.json and ./.claude/settings.local.json when one exists.
~/.claude.json, ~/.mcp.json- Claude Code MCP server definitions. Read by vet, along with a project-local ./.mcp.json when one exists.
~/.claude/plugins/, ~/.claude/skills/- Installed Claude Code plugins and skills. Vet reads each plugin.json and skill.json manifest for its install source and integrity marker.
~/.codex/config.toml, ~/.codex/hooks.json- Codex CLI MCP server definitions and hooks. Read by vet.
~/.cursor/mcp.json, ~/.cursor/hooks.json- Cursor MCP server definitions and hooks. Read by vet.
~/.copilot/mcp-config.json, ~/.copilot/config.json- Copilot CLI MCP server definitions and configuration. Read by vet.
~/.gemini/settings.json- Gemini CLI MCP server definitions. Read by vet.
Guard hook hosts
The hook events skarn guard receives on each supported host, what each event lets the guard scan, and the decision channel it answers on. Events marked opt-in are supported but not wired by the shipped configs.
Claude Code
Claude Code fires PascalCase events with a JSON envelope on stdin. Five events are wired by default; the two output-scanning events are supported but opt-in because they fire on every tool result.
Codex shares Claude's PreToolUse and PermissionRequest names, so auto-detection keys on a Codex-only tell (turn_id, or the apply_patch/spawn_agent tools); a Claude event carries none of them and routes to the Claude adapter. VS Code Copilot also shares the envelope, so its own tool-name vocabulary routes it to the Copilot adapter. The shipped Claude PermissionRequest hooks pass --agent claude explicitly anyway.
A non-zero guard exit fails closed on the blocking events. An unparseable event asks in enforce mode.
Cursor
Cursor fires camelCase events, each with its own stdin shape and its own verdict schema - unlike Claude's single envelope. All four blocking events are wired by default.
The camelCase event names are unique to Cursor, so auto-detection is unambiguous.
Fail-open by default; --strict plus enforce exits 2 (Cursor's schema-agnostic hard block) on an unparseable event.
Codex CLI
Codex's hook system mirrors Claude's - PascalCase events and a near-identical PreToolUse JSON - but its verdict semantics differ: permissionDecision ask and a bare allow both FAIL OPEN, so a would-be ask degrades to deny.
Codex shares Claude's event names, so pass --agent codex explicitly. Auto-detection falls back to a Codex-only tell: turn_id (on every turn-scoped event, PermissionRequest included) or the apply_patch/spawn_agent tools.
Fail-open by default; --strict plus enforce emits an explicit deny JSON on an unparseable event.
GitHub Copilot CLI
The Copilot CLI's native payload is camelCase (toolName / toolArgs / sessionId) and carries no event-name field, so the event is inferred from the field shape. Only preToolUse can actually block; the other events run full detection and write the audit log but cannot decide.
The camelCase field set is the CLI tell. A Copilot payload in Claude-compat mode is byte-indistinguishable from a real Claude event (field names AND tool names), so the shipped Copilot configs always pass --agent copilot explicitly.
preToolUse fails CLOSED on a non-zero exit, but a hook TIMEOUT fails OPEN (the shipped configs set timeoutSec 10).
GitHub Copilot (VS Code agent mode)
VS Code agent mode speaks a second Copilot dialect: PascalCase event names in a Claude-shaped envelope, camelCase tool_input keys, and VS Code's own tool-name vocabulary (run_in_terminal, create_file, ...), which Skarn maps to canonical names. MCP calls arrive as PreToolUse with an mcp_<server>_<tool> name.
VS Code discovers hooks from ~/.claude/settings.json (chat.hookFilesLocations), so a machine already running Skarn's Claude guard receives VS Code Copilot events. The VS Code tool-name vocabulary routes them to the Copilot adapter instead of a silent Claude fast-allow; the shipped configs pin --agent copilot.
VS Code blocks only on exit 2; any other non-zero exit fails OPEN.
Examples
Show which license this machine is using, where it came from, and when it expires.
skarn license
Validate a license file and install it; the previous license, if any, is backed up alongside it.
skarn license ~/Downloads/team.skarnlicense
Fetch a fresh license for this subscription, verify it against the keys built into this binary, and install it; nothing is written unless it verifies.
skarn license renew
Scan every AI coding session on this machine and print a friendly risk summary in one command; no flags, no license.
skarn assess
Write a self-contained, redacted security report to share with a colleague; -o report.md writes a plain-text version.
skarn assess -o report.html
Statically vet this machine's AI assistant configuration - hooks, MCP servers, permission grants, plugins and skills - and list the risky patterns found. Read-only, offline, no license.
skarn vet
Emit the config findings as SARIF for a code-scanning pipeline and exit 1 on anything high or above; an unreadable config file exits 6 rather than reporting a partial view as clean.
skarn vet --format sarif --fail-on-severity high
Detect installed AI coding agents and wire the guard hook into each one in audit mode, with a wizard on a terminal; ends with the guard self-test and a list of every file touched.
skarn setup
Print the exact Cursor hooks.json content that setup would write, without writing anything.
skarn setup --print --agent cursor
Check that skarn is really protecting this machine: license, every wired agent hook, the guard log, and the guard self-test. Each warning or failure names the command that fixes it.
skarn doctor
The same checks as one JSON object for fleet scripts; the check ids are stable and always exits 0.
skarn doctor --json
Flip every agent that already carries skarn entries from audit to enforce, leaving everything else alone.
skarn setup --update --mode enforce
Summarize the last 30 days of flagged calls per agent (verdicts, top rules, latency, the most recent denies) and, when the window is clean, print the exact command that flips the hooks to enforce.
skarn guard report --window 30d
The same aggregate as one JSON object for fleet scripts: counts are over flagged actions, since the guard does not log clean calls.
skarn guard report --format json
Accept a finding the guard flagged (the fingerprint printed under the deny in guard report) as a false positive, so the identical call stops being blocked. Writes the personal baseline the guard reads; a real leak is never accepted this way.
skarn guard accept 7d343e3a105ae026589b3371d565a4ad2943dd5ba5f81a19c7500b2ab4dbb1f0 --reason 'internal test credential'
Prove the guard wiring: run synthetic benign and fake-credential events through each adapter's real code path and report the verdicts (credential shown redacted).
skarn guard --self-test
Scan the default window (the last 30 days) of all sessions for leaked secrets and attack patterns.
skarn check
Scan all history, report only high-severity-and-above findings, and emit JSON for a pipeline.
skarn check --hours 0 --severity high --format json
Exit non-zero in CI when a session's risk score exceeds 60.
skarn check --fail-on-risk 60
Search past sessions for a regular-expression pattern.
skarn search 'AWS_SECRET' --regex
List recent Claude Code sessions.
skarn recent --cli claude
Render per-project analytics to a self-contained HTML file.
skarn stats --by project --format html -o stats.html
Browse and scan sessions in a local web UI on 127.0.0.1:7777 (localhost only, no egress); open the token-carrying URL printed at startup.
skarn serve --port 7777
Serve the web UI with a custom rule pack layered on the bundled rules; the Security view surfaces its findings too.
skarn serve --rules ./team-rules.toml
Walk each new finding and label it a true or false positive with a reason; the decisions are written into the committed baseline and survive re-scans.
skarn baseline audit .skarn-baseline.json
Record a single false-positive fingerprint (from SARIF partialFingerprints or the ndjson skarn.fingerprint field) into the baseline without the interactive loop.
skarn baseline accept .skarn-baseline.json 7d343e3a105ae026589b3371d565a4ad2943dd5ba5f81a19c7500b2ab4dbb1f0 --reason 'internal test credential'
Security
Skarn scans locally and makes no network connection by default. Secrets are redacted in every output format unless --no-redact is given.
The only feature that transmits anything off the machine is the maintained feed: --update-rules and --feed-url fetch a signed feed bundle from the subscriber channel. No secret ever leaves the machine. It is off by default and is disabled by --offline.
skarn vet reads the AI assistant configuration files listed under FILES read-only: it opens each one for reading, never writes, rewrites, or removes one, and makes no network call. It reports what it finds and leaves every decision about the configuration to you. --offline is accepted for parity and changes nothing.