A few days ago, an agent-tool vendor disclosed a breach that exposed
provider API keys stored in its console workspaces. My first thought
wasn't about their infrastructure. It was much more embarrassing:
Which keys do I even have, and where are they stored?
I couldn't answer that in under a minute. And I suspect most developers
can't. A provider key gets pasted into one agent tool's config, then
another's, then an .env file, then shell history — and every copy is
another place it can leak from, and another line on the bill if someone
abuses it.
So I built a small tool that answers the question locally: keymap.
One command, no dependencies, no network:
python -m keymap
It scans the config files your agent tools, CLIs and shells actually
read — ~/.claude.json, ~/.codex/config.toml, ~/.env, shell rc
files and history, ~/.aws/credentials, and friends — and reports:
*_API_KEY /
*_TOKEN / *_SECRET variable it doesn't recognise),chmod 600 it),git add . away from a commit — or
already tracked.
It finishes with a rotation checklist: the exact revoke page for every
provider it found. After a vendor breach, that's the difference
between a scavenger hunt and a checklist.
sk-ant-…) plus a SHA-256 fingerprint prefix, so you can recognise
the The repo ships examples/demo-home/ — a fake home with the same
Anthropic key in two files, an OpenAI key in .env and shell
history, a GitHub token, and a world-readable .env:
sh examples/run-demo.sh
If you run it on your real home and find a key in five places, you're
not careless — you're normal. That's exactly why I built it.