See and revoke what your AI coding agents can access

AI Access Auditor

See everything your AI coding agents can access on your computer, and take any of it back.

Claude Code, Codex, Gemini CLI, Cursor, OpenCode and other agents collect permissions over time: auto-approved commands, MCP servers with tokens, trusted folders, saved logins, API keys left in their logs. AI Access Auditor finds all of it, explains each item in one line, and lets you remove it with one click, with undo.

Demo with invented data: revoke a risky permission, then undo it from History.

Install

Download from the website (free), or from the latest release.

What it does

• Finds every grant: tool and command permissions, MCP servers, trusted folders, hooks, saved logins, API keys in your shell and environment, startup entries, and secrets left in agents' session logs (shown masked).

• Explains and scores them: a safety score, and a one-line explanation of each risk.

• Shows what's actually used: when each permission, folder and MCP server was last used, from the agents' own session logs (Claude Code, Codex CLI and Gemini CLI). Grants never used are marked "Unused", and one click revokes them all.

• Takes access back: revoke one grant or many at once, now or after a time limit. Every change is backed up first and can be undone.

• Watches for changes: a popup the moment an agent gains new access. Keep it, keep it for a while, or remove it.

• Asks before agents act: an optional popup before Claude Code, Codex or Gemini CLI runs a tool, through their own hook systems.

Command line

The same scan runs in a terminal, in scripts and in CI. It needs Node.js 18 or later, and nothing is installed:

        npx github:dirmedmr-alt/ai-access-auditor --scan          # every grant, grouped by agent
npx github:dirmedmr-alt/ai-access-auditor --unused        # only grants never used
npx github:dirmedmr-alt/ai-access-auditor --json          # as JSON, keys and tokens masked
npx github:dirmedmr-alt/ai-access-auditor --fail-on high  # exit code 1 if a high-risk grant isn't marked as reviewed
      

Or from a copy of this repository: node server.js --scan. Run --help for every option.

Updates

When a new version is out, the app downloads it in the background from this repository's releases and checks it before anything is installed: the checksum published with the release must match, and on a Mac the app must also be signed with this developer's Apple Developer ID and notarized by Apple. Then one click on Restart to update installs it. The .deb packages, which need administrator rights, keep a download link instead.

Privacy

Everything stays on your computer: no account, no telemetry. The only network request is a daily check for a new version on GitHub, which you can turn off in Setup. The local server listens only on 127.0.0.1, checks a per-session token, and masks secrets in its output.

Security

Read the security reviews: the first, and the second, from issues reported by Mohamed Lemine. To report a problem privately, see SECURITY.md.

Full details

On Linux the app lives in the tray instead of the menu bar. It finds the same agent access, and in place of the Mac-only parts it checks systemd and autostart jobs, logins saved in GNOME Keyring or KWallet (by name only), and membership of the docker group. On Windows it checks startup entries (registry and Startup folder), scheduled tasks, logins in Credential Manager, API keys in the user environment, and admin rights without a UAC prompt. Uploads aren't watched on Windows.

What it scans

• Claude Code: tool permissions, permission modes, trusted folders, MCP servers and hooks

• Claude Desktop: folder grants, browser control, scheduled tasks and permission bypass

• MCP servers in Cursor, VS Code, Windsurf, Gemini CLI, Zed, Codex, Cline and Roo Code

• macOS privacy grants for AI apps and terminals (this needs Full Disk Access)

• Saved logins for AI tools and GitHub in your Keychain (names only, never the secrets)

• Background agents: LaunchAgents and LaunchDaemons, plus crontab lines that start AI tools

• AI extensions in VS Code, Cursor and Windsurf, and in Chrome, Brave, Edge and Arc

• Local AI servers (Ollama, LM Studio) that other devices on your network can reach

• Other agents' permissions: Codex: approval policy, sandbox and trusted projects Gemini CLI: auto-accept, allowed tools and trusted folders Cursor CLI: allow rules Copilot CLI: trusted folders, allow-all mode, allowed URLs, and the "always allow" answers it saved per project Windsurf: Cascade's command allow list Kiro: trusted commands, and the allow rules in permissions.yaml (Kiro 1.0) Zed: its agent's tool permissions, and the older "always allow" switch Continue: tools its CLI (cn) may use without asking, and MCP servers in config.yaml Cline: the CLI's auto-approve settings, and MCP tools set to run without asking (Cline, Roo Code) VS Code, Cursor and Windsurf: Copilot auto-approve settings OpenCode: permissions Aider and Goose: auto modes MCP servers in Copilot CLI, Amazon Q, Kiro, OpenCode, Continue, Cline CLI and Claude Desktop extensions

• Codex: approval policy, sandbox and trusted projects

• Gemini CLI: auto-accept, allowed tools and trusted folders

• Cursor CLI: allow rules

• Copilot CLI: trusted folders, allow-all mode, allowed URLs, and the "always allow" answers it saved per project

• Windsurf: Cascade's command allow list

• Kiro: trusted commands, and the allow rules in permissions.yaml (Kiro 1.0)

• Zed: its agent's tool permissions, and the older "always allow" switch

• Continue: tools its CLI (cn) may use without asking, and MCP servers in config.yaml

• Cline: the CLI's auto-approve settings, and MCP tools set to run without asking (Cline, Roo Code)

• VS Code, Cursor and Windsurf: Copilot auto-approve settings

• OpenCode: permissions

• Aider and Goose: auto modes

• MCP servers in Copilot CLI, Amazon Q, Kiro, OpenCode, Continue, Cline CLI and Claude Desktop extensions

• Agents running right now with approvals off (--dangerously-skip-permissions, --yolo, --full-auto, -y, and so on) or as root. These can be stopped from the popup

• Secrets in agents' session history: keys, tokens and private keys left in the session logs agents keep on disk (only masked previews are shown), with one click to remove them from the log, and a link to cancel each key with the service that issued it (removing it from the log doesn't stop it from working)

• Left behind after uninstalling: agents you removed whose folder still holds saved logins, permissions or past conversations

• Data sharing: agents' usage statistics and telemetry, sessions shared publicly, and editors' usage data, with one click to turn each off; plus links to each AI service's training settings

• Privileges every agent inherits from you: passwordless sudo, loaded SSH keys, and GitHub, AWS, gcloud, Azure, Kubernetes, Docker and npm logins

• API keys exported in your shell startup files

• Optional "watch all apps": macOS privacy permissions and background jobs for every app, not just AI apps

Menu bar and alerts

The Mac app stays in the menu bar after you close its window. Every 5 minutes it checks for new access. When an agent gains something new, the shield turns red, a notification shows what was added, and the grant is labeled "New" in the app. "Open at Login" in the shield menu starts it quietly when you log in. Grants that exist on the first run become your starting list, so you're only alerted about changes after that.

Live protection

• New access pops up right away. The app watches the agents' config files. When anything gains access, a floating window asks whether to Keep it (forever, or for 1 hour, 1 day or 7 days) or Remove it.

• Ask before agents act (switches on the Overview; one hook script, gate.js, for all three): Claude Code: a PermissionRequest hook in ~/.claude/settings.json. The popup replaces Claude Code's prompt; Allow can be "just this once" or "always". Codex CLI: PermissionRequest and PreToolUse hooks in ~/.codex/hooks.json. The popup replaces Codex's prompt, and also steps in when Codex runs without asking (bypass / full-auto). Codex asks you to trust new hooks once (/hooks). Gemini CLI: a BeforeTool hook in ~/.gemini/settings.json. Gemini's own prompt can't be skipped, so the popup only appears when Gemini wouldn't ask (YOLO, or edits in auto-edit mode). If the app isn't running, each agent works as usual. Every answer is listed under Decisions.

• Claude Code: a PermissionRequest hook in ~/.claude/settings.json. The popup replaces Claude Code's prompt; Allow can be "just this once" or "always".

• Codex CLI: PermissionRequest and PreToolUse hooks in ~/.codex/hooks.json. The popup replaces Codex's prompt, and also steps in when Codex runs without asking (bypass / full-auto). Codex asks you to trust new hooks once (/hooks).

• Gemini CLI: a BeforeTool hook in ~/.gemini/settings.json. Gemini's own prompt can't be skipped, so the popup only appears when Gemini wouldn't ask (YOLO, or edits in auto-edit mode).

• If the app isn't running, each agent works as usual. Every answer is listed under Decisions.

• New AI agents: when Claude Code, Codex, Gemini or another agent or AI app appears on the Mac, a popup offers to turn on Allow / Deny for it.

• AI tools being installed: npx … setup, npm install -g, brew install, pipx, uv tool install and … mcp add of MCP servers, skills or agent packages, with who started it and what it's connecting to.

• Data leaving the Mac: per-process upload counters (nettop, every 2 s). Programs an AI agent started are flagged from 64 KB to one address, other apps from 20 MB, with the sensitive files they have open. Stop it, allow it once, or always for that app.

• Agent skills, sign-ins and "always allow" rules: skills in every agent's skills folder; logins saved as plain text (~/.codex/auth.json, ~/.gemini/oauth_creds.json) or in the Keychain; Gemini's saved policy rules. All revocable, with a backup.

• macOS privacy prompts (Screen Recording, Accessibility and so on) come from the system itself, so the app can only report them afterwards.

Actions

• Revoke: backs up the file first. You can also tick several grants and revoke them together.

• Revoke automatically: after 1 hour, 1 day, 7 days or 30 days.

• Mark as reviewed: for grants you want to keep.

• Restore: on the History tab.

Every action is logged in ~/.ai-access-audit/.

Build it yourself

./build-app.sh, then open dist/AI Access Auditor.app, or ./build-app.sh --install to put it in /Applications. It needs Node.js (brew install node) and doesn't use a browser. The Linux and Windows app is in desktop/ (Electron); see build-linux.sh and appveyor.yml.

        npm start        # browser version: open the link it prints (it contains the page's access token)
npm run scan     # print the findings in the terminal
      

Releases

Releases are built and published by the maintainer. The Mac app is signed with a Developer ID and notarized by Apple (macos/node.entitlements lets the bundled Node.js compile JavaScript). Linux files are built with build-linux.sh, and the Windows installers are built and tested by AppVeyor (appveyor.yml) on every push. Each release publishes SHA-256 checksums for every file.

Screenshots come from invented demo data (AUDIT_DEMO=1), never from a real Mac.