Past-session check

Find known credentials in past AI coding agent sessions.

Stroq checks the Claude Code, Codex CLI and Cursor sessions on your machine for credential values known on your machine. For each key it finds, it says what it saw: sent to another company, maybe sent, seen by the AI, used with its own service, or blocked before it ran. It names the source, the call and the time, never the value. You can check sessions recorded before installing Stroq hooks.

What does stroq sent check?

With no option, Stroq reads every session the agents still keep; --here reads this project's, --last the newest one. It compares their calls, results, prompts and replies with the current values of your keys: ~/.aws/credentials, ~/.npmrc, ~/.netrc, ~/.docker/config.json, the env files of each folder a session ran in and of the folders above it up to its repository's root, and credential-named environment variables. A key is reported once, by name and source, under the most external place a call put it, with that call.

The report says what it read: how many sessions, which key files supplied the keys, and, under "Not checked", what it could not read or compare. This matters most when no key value is found.

How to run it

The first command reads every session on the machine. Run the others from the project directory you want to inspect. A transcript path lets you choose one session explicitly.

npx @stroq/cli sent
npx @stroq/cli sent --here
npx @stroq/cli sent --last
npx @stroq/cli sent --transcript /path/to/session.jsonl
npx @stroq/cli sent --json

No prior Stroq hook installation is needed for the transcript scan. For repeat use, npm install -g @stroq/cli avoids an npx package fetch at invocation time. See the full guide for the audit-log form, Cursor session addressing, --counts, --card and --fail-if.

No session to scan yet? Try it with a made-up key.

Run the built-in sample. It runs the whole check, in memory, on a made-up session with a made-up key: it reads no file on your machine and writes nothing.

npx @stroq/cli sent --try

The report shows what a key sent to another company looks like, and names STRIPE_SECRET_KEY without printing its value.

What a finding means

The built CLI's output for made-up keys, trimmed:

stroq sent: did your AI agent pass your keys on?

6 of your 6 keys appear in your agent sessions: 2 sent to another company, 1 maybe sent, 1 seen by the AI, 1 used with its own service, 1 blocked before it ran.

Checked 3 sessions (Claude Code 2, Codex 1), 2026-10-02 to 2026-10-19.
Compared with 6 keys: ~/.aws/credentials, ~/.npmrc, ~/work/shop/.env, ~/work/api/.env.

SENT TO ANOTHER COMPANY: rotate these today (2)
 1. STRIPE_SECRET_KEY  from ~/work/shop/.env
    went to  collector.example, in a curl command
    when     2026-10-11 14:02 UTC · Claude Code · ~/work/shop
    do       revoke it at https://dashboard.stripe.com/apikeys, then update ~/work/shop/.env

SEEN BY THE AI: your agent's model saw these keys (1)
 4. aws_secret_access_key  from ~/.aws/credentials
    seen in  the output of a Read of ~/.aws/credentials
    when     2026-10-02 09:42 UTC · Claude Code · ~/work/api
    note     Not ruled out: 2 later commands in that session could reach the network.
    do       your agent's model saw it; rotate it if that matters: https://console.aws.amazon.com/iam/home#/security_credentials

Stroq names a send only when it sees the key in the command that sent it. A script, a file or a variable can carry a key out without showing it.

The first line counts what was seen, by place. Sent to another company: a call carried the key to a host that is not the key's own service. Maybe sent: a program ran with it, a file it was written to was later sent or run, or Stroq could not read all of what carried it. Seen by the AI: your agent's model saw it, in an output, a prompt, a reply or a command that only reads. Used with its own service: only by a strict proof, such as an OpenAI key in the auth header of one plain request to api.openai.com. Blocked before it ran: Claude Code records the call as refused or blocked; a Codex or Cursor log that says a call was stopped proves nothing, and the call keeps its place with that note.

Provider delivery is not verified. A local transcript cannot prove which bytes a model provider received, whether a result was truncated before transmission, what the provider retained or whether anyone used the credential. Treat a finding as a reason to investigate and rotate a sensitive credential, not as proof of an external breach.

A finding does not change the command's default exit status: a produced report exits 0 even with findings. Use --fail-if third-party or --fail-if any when a scheduled check should return 1. With no session to read, the text report says so and exits 1.

What stays on your machine?

The check runs locally. It reads the sessions and your key files to compare exact values, holds the values in memory only, and sends nothing. It writes nothing either: no index, no temporary copy. The one exception is a card you ask for with --card --out <file>, which it writes to that new file only. The report prints names and source paths, never a value. Review it before sharing, because names, paths and hosts can still be sensitive; --card holds counts only.

On a first npx invocation, npm may download the CLI package. Install the package ahead of time if you need the check to run without a package download.

Coverage and limits

  • Known values only. A credential rotated or deleted since the session is no longer in your key files and cannot match. Split, encoded or otherwise transformed values may also be missed.
  • Only what it saw. Stroq names a send only when it sees the key in the command that sent it. A script, a file or a variable can carry a key out without showing it, so a milder place means no send was seen, not that none happened.
  • Three transcript readers. Claude Code, Codex CLI and Cursor are supported. Cursor uses a SQLite store and needs a Node version with node:sqlite; Stroq reports when that reader is unavailable. Windsurf, Copilot CLI and Antigravity histories are not claimed here.
  • Audit logs are narrower. When scanning Stroq's own audit log instead of an agent transcript, tool-result text is unavailable; only call arguments and credential-file evidence can be checked.

When no value is found, the report says only that your keys' values do not appear in the session logs, and lists what it did not check. A run that could not read everything says so on its first lines.

What to do next

  1. Review the named call and source in the local transcript. Confirm whether the credential is still active and rotate it if exposure matters.
  2. Run stroq exposure to inspect which agent channels and MCP servers are actually guarded on this machine.
  3. Use stroq init and stroq doctor to add and check forward-looking hooks. The security limits explain where hooks cannot enforce a boundary.

For transcript formats, exact commands and report fields, see the full guide and source code on GitHub.