For agents you build, Weir plants fake credentials where real ones would live, runs the agent's normal flows, and checks what comes out: telemetry, logs, console output, model requests, and requests to other services. It looks for those exact values, including common encoded forms, and reports where they went without printing the credential.
pip install weir-scan weir canary judge --sample
That sample shows a planted key leaking into a trace. On your own agent: pip install weir-run.
For agents you use, Weir can inventory your real credentials (it stores keyed fingerprints, never the values) and show when one enters your session or leaves in a tool call. Right now, this is supported for Claude Code. Its optional hook redacts those known credentials from tool results before the model sees them. Setup is weir statusline setup, on Linux and macOS for now.
So the two modes are deliberately different:
Build: plant → run → prove where the credential went. Use: observe → warn → optionally redact before the model sees it.
The test mode is deterministic and offline. On Linux it can also run the agent without outside network access, so direct exfiltration attempts are caught. If a required path wasn't exercised, Weir reports incomplete, never clean.
It doesn't try to detect every possible secret. It matches known whole values, so hashed, split, truncated, or otherwise transformed credentials aren't covered. The Claude Code hook only protects the tool-result boundary: it can't undo a credential already pasted into the conversation, and a failed command's output reaches the model as is.
Apache-2.0, no model in the loop, and Weir itself sends nothing anywhere. It found GHSA-j7qq-vr8c-xvw3 in MLflow (fixed in 3.17.0).
Built with AI assistance; every security finding was reproduced before I reported it.