After the agent-tool breach, I asked: where do my API keys actually live?

A developer built keymap, a dependency-free local Python tool that scans the config files agent tools, CLIs and shells read — including ~/.claude.json, ~/.codex/config.toml, ~/.env, shell rc files and history, and ~/.aws/credentials — to inventory where provider API keys and secrets are stored. The tool reports each key's location, flags world-readable files and keys staged for or already in git, and ends with a rotation checklist linking the revoke page for each provider. The developer created it after an agent-tool vendor breach exposed provider API keys in its console workspaces, noting that finding a key in five places is normal rather than careless.

A few days ago, an agent-tool vendor disclosed a breach that exposed provider API keys stored in its console workspaces. My first thought wasn't about their infrastructure. It was much more embarrassing: Which keys do I even have, and where are they stored? I couldn't answer that in under a minute. And I suspect most developers can't. A provider key gets pasted into one agent tool's config, then another's, then an .env file, then shell history — and every copy is another place it can leak from, and another line on the bill if someone abuses it. So I built a small tool that answers the question locally: keymap . One command, no dependencies, no network: python -m keymap It scans the config files your agent tools, CLIs and shells actually read — ~/.claude.json , ~/.codex/config.toml , ~/.env , shell rc files and history, ~/.aws/credentials , and friends — and reports: API KEY / TOKEN / SECRET variable it doesn't recognise , chmod 600 it , git add . away from a commit — or already tracked. It finishes with a rotation checklist: the exact revoke page for every provider it found. After a vendor breach, that's the difference between a scavenger hunt and a checklist. sk-ant-… plus a SHA-256 fingerprint prefix, so you can recognise the The repo ships examples/demo-home/ — a fake home with the same Anthropic key in two files, an OpenAI key in .env and shell history, a GitHub token, and a world-readable .env : sh examples/run-demo.sh If you run it on your real home and find a key in five places, you're not careless — you're normal. That's exactly why I built it.