What would an infostealer find on YOUR machine? I built a CLI that answers exactly that

#typescript #security #cli #devops

In October 2026, Check Point Research reported the Aokigahara campaign: infostealers sweeping developer machines for authentication files, session data, and configs of AI coding assistants -- Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and others. Reading that report made me ask an uncomfortable question: if one of those landed on MY machine, what exactly would it find?

I had no good answer. So I built sessguard: a local, read-only, zero-network CLI that inventories AI-assistant session and credential material on your machine -- and hands you a per-app revocation checklist. It never prints, logs, or exports token values: findings carry paths, file metadata, and pattern-match counts only.

The gap it fills

Secret scanners like TruffleHog own the repository surface. They are excellent at that, and to be fair, that is where they beat sessguard: if your secrets already leaked into git history, you want TruffleHog, not this tool. OSQuery can answer endpoint questions, but only with hand-written queries per app that you maintain yourself. Nobody maps "AI session material on THIS machine" to "here is exactly how to revoke each one". That one-to-one mapping is the gap: curated, dated path knowledge for 10 AI assistants, strict no-value reporting, and an actionable revocation checklist.

What it does

Two commands:

inventory -- scan well-known session/config paths, report paths, file metadata, and token-pattern match counts. Never values.
checklist -- per-app revocation checklist: what each store typically holds, where to revoke it, how.

A real run against the synthetic demo profile (all fixtures fake, values never leave the machine):

$ SESSGUARD_ROOT=examples/demo-profile node dist/cli.js inventory
AI SESSION STORES ON THIS MACHINE
Token values are never shown -- paths, file metadata, and match counts only.

Apps with stores found: 6/10

- Claude Code / Claude CLI:
    stores: .claude.json, .claude
    files: 2, total size: 634 bytes
    newest: today, oldest: today
    files matching token patterns: 1 (6 matches -- values hidden)
- Codex CLI:
    stores: .codex/auth.json, .codex
    files: 2, total size: 378 bytes
    newest: today, oldest: today
    files matching token patterns: 1 (6 matches -- values hidden)
- Cursor:
    stores: .cursor
    files: 1, total size: 231 bytes
    newest: today, oldest: today
    files matching token patterns: 1 (2 matches -- values hidden)
...

And the checklist tells you exactly where to click:

$ SESSGUARD_ROOT=examples/demo-profile node dist/cli.js checklist
REVOCATION CHECKLIST

## Claude Code / Claude CLI
Stores: .claude.json, .claude
Typically holds: API keys, OAuth session tokens, project session transcripts
Revoke: https://console.anthropic.com/settings/keys
How: Revoke API keys at the console. For OAuth sessions, sign out inside the app as well.
Also rotate: Any API keys you used with Claude Code

Every path entry carries the date it was last verified (2026-10-30 for all ten apps in this release), because apps move their storage locations and stale path lists are worse than none. Terminal recording of a real run:

What it is NOT

It does not prevent infostealer infection.
It does not detect exfiltration.
Absence of findings is not evidence that a machine is clean.

It is a hygiene and incident-response checklist tool. It answers "what AI session material lives on this machine, and how do I revoke each one" -- nothing more.

How it is built

TypeScript, zero runtime dependencies, Node.js 20+. Read-only: the scanner never writes, follows no symlinks, and reads at most 2 MB per file. Zero network: CI runs the full suite with networking disabled, and a static test asserts no networking API exists in the source. The redaction self-test plants fake secrets in the demo profile and fails the build if any of them reaches the JSON output. The path list is public knowledge (documented by vendors and threat research), so the tool cannot be used as an exfiltration aid -- and it makes no network calls anyway.

Try it

git clone https://github.com/techdevfun/sessguard.git
cd sessguard
npm ci && npm run build
node dist/cli.js inventory
node dist/cli.js checklist

MIT licensed. Roadmap: an npm package (so npx sessguard inventory just works), more assistants as their storage paths get verified, and scheduled re-verification of revocation URLs.

Repo: https://github.com/techdevfun/sessguard

DEV Community