Ranwhat

Ranwhat is a flight recorder and secret scanner that audits actions for AI coding agents.

Ranwhat operates as a local flight recorder and secret scanner for artificial intelligence coding agents like Claude Code, Codex, and Gemini CLI. It reads session histories written to disk to surface irreversible actions, security risks, and exposed credentials. The tool runs locally without requiring an account, internet connection, or external dependencies. It provides commands to inspect agent logs, evaluate reachable MCP servers, and export findings in SARIF format. Designed for developers using AI coding tools, it runs on local machine environments and supports dozens of agent history formats.

Ranwhat at a glance

Best for: Software engineer
Runs on: macOS, Windows, Linux, API, self-hosted, open source
Pricing: Free
Released: October 2026
Category: AI coding tool
Website: github.com/matijamiki/ranwhat

Key features

Scans agent session histories for secrets and irreversible actions
Supports over thirty different AI coding agents
Exports findings in SARIF 2.1.0 format for code scanning
Runs locally with no account or telemetry
Provides read-only audit passes with status reporting
Integrates as a Claude Code plugin with custom commands

Use it for

Auditing commands run by AI coding agents on local machines
Scanning agent transcripts for exposed credentials and API keys
Exporting security scan results to SARIF format for analysis
Checking agent accessibility to credential files and MCP servers

Alternatives to Ranwhat

Rashomon — Verifies whether Claude Code actually completed tasks or hid command failures.
Stroq — Scans recorded sessions and guards future actions with local hooks.
Airuncode — Runs agents locally on your machine with direct provider billing.
Coucou — It provides open-source, real-time agent monitoring and approvals directly from the screen notch.
Arcjet — Enforces security policies directly at the action boundary inside your application code.
Wy — Links file changes directly to agent chat transcripts.
Runway — Control Claude Code and Codex sessions on local or cloud machines from any phone.
Whatsmyagentdoing — Track every local Claude Code, Codex, and Gemini CLI agent in a live visual office.
jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
Fresh Jots — Tracks scripts and AI sessions with tamper-evident logs and dead man switches.
Agent Archive — Hand off coding sessions between Claude Code, Codex, and Cursor across machines.
Agentic CleanSlop — Runs entirely inside AI agents with one pasted line.

All Ranwhat alternatives