Skarn is a security scanner for the AI coding-assistant session logs on a developer's machine. It covers Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot, Copilot in Code, Kimi Code CLI, Grok Build, Grok Bot, Antigravity, OpenCode and Cline, plus Cowork and Claude Enterprise sessions from Compliance API exports, from a single static binary, and detects leaked credentials across 200+ types using 253 built-in rules, plus multi-stage attack chains - prompt injection to secret read to exfiltration - correlated across MITRE ATLAS tactic-aligned stages. Every finding is crosswalked against MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, and CWE, emitted as SARIF 2.1.0 for GitHub code scanning, and every session and team gets a 0-100 risk score. Secrets are always shown redacted, never in full. A real-time pre-execution guard hook for nine of those assistants (Claude Code, Cursor, Codex CLI, GitHub Copilot, Gemini CLI, Grok Build, Antigravity, Kimi Code CLI and Cline) can refuse a leaked credential before the tool call runs. Skarn makes zero network calls by default and is built for regulated, audit-heavy, EU data-residency environments where nothing may leave the machine.
No comments or reviews, maybe you want to be first?