TECHDEV · Flagship · Open-source tool

sessguard

What would an infostealer find on your machine? A local, read-only, zero-network CLI that inventories AI-assistant session and credential material on your endpoint and gives you a per-app revocation checklist. Token values are never printed.

View on GitHub →Read the article →

TypeScript · CLI · MIT · Node 20+ · Zero runtime dependencies · Local, read-only, zero network. No account, no tracking, no data leaves the machine. Token values are never shown: paths, file metadata, and match counts only.

The problem it answers

Modern infostealers sweep developer machines for authentication files, session data, and configs of AI coding assistants: Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and others, alongside Git credentials, SSH keys, and API keys. The Aokigahara campaign reported by Check Point Research in October 2026 showed exactly this playbook. When incident response starts with "what was on the machine", teams have no map of the AI-assistant surface and no per-app revocation steps. Secret scanners own the repository surface; OSQuery answers endpoint questions only with hand-written queries per app. sessguard fills the gap between "AI session material on this machine" and "here is exactly how to revoke each one": curated, dated path knowledge for 10 AI assistants, strict no-value reporting, and an actionable per-app revocation checklist.

Two commands

Command	What it does
`sessguard inventory`	Scans well-known session/config paths on this machine. Findings carry paths, file metadata, and token-pattern match counts only. Values are never printed, logged, or exported.
`sessguard checklist`	Emits a per-app revocation checklist for every app with session material found: what the stores typically hold, where to revoke, and what to rotate alongside.
`sessguard --version`	Prints the version.

Both commands accept --json out.json for machine-readable output with the same data and still no values. The SESSGUARD_ROOT environment variable overrides the scan root (used by the demo and tests). The repository ships a terminal recording of a real run against the synthetic demo profile (examples/demo.gif), recorded via pty capture; a documented real-run transcript is in the README.

Coverage — curated, dated path knowledge

Apps move their storage locations, so each entry carries the date it was last curated. All entries below were last verified on 2026-10-30 (README, 2026-10-30 release):

App	Last verified
Claude Code / Claude CLI	2026-10-30
ChatGPT Desktop	2026-10-30
Codex CLI	2026-10-30
Cursor	2026-10-30
Windsurf	2026-10-30
GitHub Copilot (IDE + CLI)	2026-10-30
Gemini CLI	2026-10-30
Amazon Q	2026-10-30
Kiro	2026-10-30
JetBrains AI Assistant	2026-10-30

Use it

# Requires Node 20+
npm install -g sessguard
# or run without installing
npx sessguard inventory

sessguard inventory [--json out.json]   # scan well-known session/config paths
sessguard checklist [--json out.json]   # per-app revocation checklist
sessguard --version

Commands copied exactly from the sessguard README (2026-10-30 release). The inventory output shown in the README is a real run against the synthetic demo profile (examples/demo-profile/, all fixtures fake), with SESSGUARD_ROOT pointing at the fixtures.

Design — three hard guarantees

Read-only. The scanner never writes, follows no symlinks, and reads at most 2 MB per file.
Zero network. No HTTP imports, no fetch, no sockets. CI runs the full test suite with networking disabled (unshare -rn), and a static test asserts no networking API exists in src/.
No values, ever. countTokenPatterns returns a number only; findings carry paths, sizes, mtimes, and counts. The redaction self-test (npm run selftest, also in CI) plants fake secrets in the demo profile and fails the build if any of them reaches the JSON output.

TypeScript, zero runtime dependencies. Dual-use note from the README: the path list is public knowledge (documented by the vendors and by threat research); the tool extracts no values and makes no network calls, so it cannot be used as an exfiltration aid.

What this is NOT — and where rivals beat us

It does not prevent infostealer infection and does not detect exfiltration. It is a hygiene and incident-response checklist tool — it answers "what AI session material lives on this machine and how do I revoke each one", nothing more. Absence of findings is not evidence that a machine is clean.
For secrets in repositories, TruffleHog beats us: that surface is theirs, not ours. For generic endpoint questions, OSQuery beats us. We cover exactly one thing well: AI session material mapped to revocation steps.
Verified dates are refreshed with each release; if an app moves its storage location between releases, an entry can be stale until the next curation pass.

Source + README on GitHub → · Report an issue → · ask@techdev.fun

Limits

It reports pattern-match counts, not confirmed credentials. A match is a candidate, not a verdict.
It inventories only the 10 curated AI assistants (plus their stores), not the whole credential surface of a machine.
It is local-only: there is no cloud dashboard, no fleet view, and no remote scan.

License

MIT. See LICENSE in the repository.

Have a say

Vote for this tool, suggest a feature, or discuss it with other operators on the community board.