Skarn

Scan this machine's AI coding assistant session transcripts for leaked credentials and risky agent behaviour, and return the redacted JSON report as a text block. Each detected secret is reported in a truncated mask that keeps at most its first character and last two characters; the surrounding transcript snippet and the transcript-authored project label are not returned. severity sets the lowest reported level, hours bounds the window (0 scans all history and is the slowest form), project narrows to one project, user narrows to the user ids or email addresses a Compliance API export recorded. compliance_withheld counts the Compliance API export sessions that were found and withheld unread because reading them needs an Enterprise license; they contribute nothing to the counts. Each incident carries confidence (high, medium or low: how likely the match is a live, usable credential after context penalties) and likely_test_value (true when the value sits in a test context); neither changes severity.

Statically vet this machine's AI assistant configuration - hook commands, MCP server definitions, permission grants, installed plugins and skills - and return the masked JSON findings report as a text block. Read-only: config files are opened for reading and never written. Project-level configuration is read from this server process's working directory.

Takes no parameters.

List recent AI coding assistant sessions as structural metadata only: session id, assistant, timestamps, message and tool counts, and token totals. No session message text is returned, and no label authored inside a transcript such as a project name, git branch or model id. hours bounds the window, limit caps the row count, project, cli and user narrow the list; a row from a Compliance API export carries the recorded user id and never the email address. compliance_withheld counts the Compliance API export sessions that were found and withheld unread because reading them needs an Enterprise license; they contribute no row.

Aggregate recent AI coding assistant sessions into counts: sessions per assistant, total messages, distinct projects, token totals and estimated cost. No session message text is returned. hours bounds the window, project, cli and user narrow what is aggregated. compliance_withheld counts the Compliance API export sessions that were found and withheld unread because reading them needs an Enterprise license; they contribute nothing to the counts.