Tool · Security check

How exposed are your agent's credentials?

Ten questions, one score, a prioritized fix list. Grounded in the OWASP agentic threat guide, the Claude Code security docs and Google SAIF. Runs entirely in your browser: no answers leave the page, and the check never asks for a token, key or secret value.

Ten questions about how your agents store, scope, rotate and audit credentials. Answers stay in this browser tab. Never paste a token, key or secret value into this page - the check works without one.

01 · Storage
Are agent credentials stored in an OS keychain or a secrets manager, not in plain-text files?
Claude Code stores credentials in the operating system keychain rather than plain config files. Anything an agent can read, a prompt-injected agent can exfiltrate.
02 · Storage
Are credential files locked down to owner-only permissions (0600 or 0400)?
Claude Code restricts its credential file to the owner with 0600 permissions. A world-readable token file leaks silently and is easy to miss for months.
03 · Scoping
Does each agent hold only the minimum scopes and permissions its tasks require?
Claude Code's permission model is built on tiered approvals: default-deny, then allow specific actions. OWASP's agentic threat guide makes least privilege its first mitigation.
04 · Scoping
Does every agent hold its own credentials instead of sharing one token across agents?
The Claude Code security docs warn about multi-credential blast radius: one leaked token should never unlock more than one system for one agent.
05 · Rotation
Do agent tokens expire on their own, or get rotated on a schedule?
Claude Code's cloud runs use short-lived, scoped tokens inside an isolated VM, so a leaked token dies on its own. Long-lived tokens stay usable for months after a leak.
06 · Rotation
Could you revoke any single agent credential within minutes, without breaking everything else?
Revocation speed is the real incident response metric for a leaked agent token. If revoking one key breaks five agents, the sharing problem above is the blocker.
07 · Runtime
Does the agent run in an isolated environment (container, VM, sandbox) separate from your personal session?
Claude Code cloud sessions run in isolated VMs with their own short-lived credentials, so the agent never touches the developer's personal logins. Google SAIF makes the same point architecturally: agents need their own security posture.
08 · Runtime
Are human and agent credentials strictly separated, so the agent never uses your personal accounts?
An agent acting with your personal session inherits your entire blast radius: email, calendar, files, payments. OWASP's agentic threats list treats confused-deputy and credential abuse as first-class risks.
09 · Audit
Do you have a written inventory of every credential every agent currently holds?
Credentials accumulate with each integration and nobody re-enters them daily, so nobody notices when one stops being needed. You cannot rotate or revoke what you have not listed.
10 · Audit
Would you notice if an agent's credential was used from an unexpected place or at an unexpected rate?
An agent with a leaked token repeats the mistake on a schedule until someone notices. Provider dashboards usually expose last-used data; alerting turns it into a signal.

Result

Answer all ten questions to get the score. 0 of 10 answered.

Sources

The full checklist with the reasoning behind each item: AI Agent Credential Check: A Security Checklist. Verify what the agent actually did with AI agent verification, and lint the instructions you hand it with the CLAUDE.md linter.