Checks

Each check has an ID. Open one to see what it finds, why it matters and how to fix it.

ID	What it finds	Severity
AP001	An API key sits in an agent’s history, transcript, paste cache, edit backups or chat database.	high
AP002	An API key sits in an agent settings or allowlist file, or inside an agent file in a package or push.	critical
AP003	An over-broad permission lets the agent run any command or skip every prompt, such as Bash(*) or bypassPermissions.	medium
AP004	An agent hook calls the network, with curl, wget, nc, a pipe into a shell, or a URL.	medium
AP005	An API key is written inline in an MCP server entry (env, headers, args, command or URL).	critical
AP006	An agent file, such as .claude/settings.local.json, would ship in your npm or PyPI package.	high, medium or low, by file
AP007	A personal agent file, such as CLAUDE.local.md, is in a git repo but not gitignored, or is already committed.	low
AP008	Agent history, settings or a key store can be read by other users on this machine (macOS and Linux).	medium; high for key stores
AP009	Source maps, original source or AI instruction files in your package hand an AI your code.	high to low by licence; no licence, UNLICENSED, SEE LICENSE IN, proprietary or only LicenseRef- choices count as closed; low for a private registry

Every print has a severity: critical, high, medium or low. --fail-on sets the lowest severity that counts (default high). The verdict is BLOCK when any print is at or above it, and CLEAR when none is.