cd /news/developer-tools/bagel-is-a-cross-platform-cli-that-i… · home › topics › developer-tools › article
[ARTICLE · art-167856] src=github.com ↗ pub= topic=developer-tools verified=true sentiment=↑ positive

Bagel is a cross‑platform CLI that inspects developer workstations

BoostSecurity released Bagel, a cross-platform command-line tool that scans developer workstations on macOS, Linux and Windows and outputs a JSON report of dev tool configurations and secret locations, recording only metadata and never secret values. Bagel runs 9 probes (Git, SSH, npm, environment variables, shell history, AWS/GCP/Azure cloud credentials, JetBrains IDEs, GitHub CLI and AI CLI tools) and 8 secret detectors, flags risky settings such as http.sslVerify=false and ForwardAgent yes, and supports a --strict flag for enforcing baseline posture checks in CI. The tool is read-only, local-first and installable via Homebrew, release tarballs or a Go 1.25 build, with an enterprise version offered as BoostSecurity Developer Endpoint Protection.

read8 min views5 publishedNov 11, 2026
Bagel is a cross‑platform CLI that inspects developer workstations
Image: Michielbdejong (auto-discovered)

Inventory what matters on developer machines—tools, configs, and metadata about secrets—to improve org supply‑chain security without exfiltrating payloads.

Bagel is a cross‑platform CLI that inspects developer workstations (macOS, Linux, Windows) and produces a structured report of:

  • Dev tool configurations and risky settings across 9 probes: Git, SSH, npm, environment variables, shell history, cloud credentials (AWS/GCP/Azure), JetBrains IDEs, GitHub CLI, and AI CLI tools.
  • Secret locations (metadata only) : presence of tokens, keys, and credentials in config files, env vars, and history—detected by 8 secret detectors—never the secret values .

For detailed documentation on each probe and detector, see the Bagel docs site.

Looking for more? If you want a more powerful, enterprise-grade version with the ability to deploy at scale and collect posture information across your entire developer laptop fleet, have a look at the BoostSecurity Developer Endpoint Protection (DEP) product.

  • No payloads. Ever. Bagel records only metadata (path, owner, perms, timestamps, config flags, key type/length/expiry). Secret values are never included in output or written to disk.
  • Local‑first. Reports are printed to stdout as JSON by default.
  • Minimally intrusive. Read‑only operations; no process injection; no network scanners.
  • Transparent. Every probe is documented and can be toggled via configuration.

Modern supply‑chain risk often lands on developer endpoints (malicious packages, misconfig creds, weak key hygiene). Bagel standardizes visibility so security teams can:

  • Find high‑signal misconfigs (e.g., http.sslVerify=false ,ForwardAgent yes , plaintext creds files, unencrypted SSH keys).

  • Detect leaked secrets in shell history, .env files, and config files.

  • Enforce baseline posture checks in CI with --strict .

  • Git :credential.helper=store ,http.sslVerify=false , customcore.sshCommand with non‑standard binaries, dangerous protocols, fsck disabled.

  • npm : tokens in.npmrc ,strict-ssl=false , HTTP (non‑HTTPS) registries.

  • SSH : keys without passphrase,ForwardAgent yes ,StrictHostKeyChecking=no , permissive file modes.

  • Environment & history : secrets embedded in env vars,.env files, or shell command history.

  • Cloud : AWS credentials, GCP API keys, Azure storage keys in config files.

Download the latest release from GitHub Releases.

macOS:

curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Darwin_x86_64.tar.gz | tar xz
sudo mv bagel /usr/local/bin/

curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Darwin_arm64.tar.gz | tar xz
sudo mv bagel /usr/local/bin/

Homebrew:

brew install bagel

Linux:

curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Linux_x86_64.tar.gz | tar xz
sudo mv bagel /usr/local/bin/

curl -sL https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Linux_arm64.tar.gz | tar xz
sudo mv bagel /usr/local/bin/

Windows:

Download bagel_Windows_x86_64.zip from the releases page, extract it, and add it to your PATH.

Invoke-WebRequest -Uri "https://github.com/boostsecurityio/bagel/releases/latest/download/bagel_Windows_x86_64.zip" -OutFile "bagel.zip"
Expand-Archive -Path "bagel.zip" -DestinationPath "."

Requires Go 1.25 or later.

git clone https://github.com/boostsecurityio/bagel.git
cd bagel
go build -o bagel ./cmd/bagel
bagel version
bagel scan

This scans your workstation and outputs findings to stdout in JSON format.

Flag Description
--format ,-f Output format: json (default),table
--output ,-o Write output to a file instead of stdout
--strict Exit with code 2 if any findings are detected
--no-cache Bypass file index cache and force rebuild
--no-progress Disable progress bars
--verbose ,-v Enable verbose (debug) logging
--config Path to configuration file
--disable-version-check Disable the once-per-day check for newer bagel releases (env: BAGEL_DISABLE_VERSION_CHECK , config:disable_version_check ) 
bagel scan -o report.json

bagel scan -f table

bagel scan --strict

bagel scan --verbose --no-progress

Bagel uses a YAML configuration file. It looks for bagel.yaml in these locations (in order):

  1. Path specified with --config
  2. Current directory (./bagel.yaml )
  3. Platform config directory (~/.config/bagel/bagel.yaml on Unix,%APPDATA%\bagel\bagel.yaml on Windows)
version: 1
probes:
  git:
    enabled: true
  ssh:
    enabled: true
  npm:
    enabled: true
  env:
    enabled: true
  shell_history:
    enabled: true
  cloud:
    enabled: true
  jetbrains:
    enabled: true
  gh:
    enabled: true
  ai_credentials:
    enabled: true
  ai_chats:
    enabled: true
privacy:
  redact_paths: []
  exclude_env_prefixes: []
output:
  include_file_hashes: false
  include_file_content: false

All probes are enabled by default. To disable a probe, set enabled: false.

By default, bagel reaches out at most once every 24 hours to check whether a newer release is available. The request reports the current bagel version, an anonymous instance identifier persisted under the platform config directory (~/.config/bagel/version-check.yaml on Unix, %APPDATA%\bagel\version-check.yaml on Windows), and a count of CLI invocations since the last check. No scan, host, or finding data is sent. To disable, use any of:

  • --disable-version-check flag
  • BAGEL_DISABLE_VERSION_CHECK=1 environment variable
  • disable_version_check: true inbagel.yaml
{
  "metadata": {
    "version": "0.1.0",
    "timestamp": "2026-02-10T12:00:00Z",
    "duration": "1.234s"
  },
  "host": {
    "hostname": "dev-laptop",
    "os": "darwin",
    "arch": "arm64",
    "username": "dev",
    "system": {
      "os_version": "15.3",
      "kernel_version": "Darwin 25.2.0",
      "cpu_model": "Apple M1",
      "cpu_cores": 8,
      "ram_total_gb": 16
    }
  },
  "findings": [
    {
      "id": "git-ssl-verify-disabled",
      "probe": "git",
      "severity": "high",
      "title": "Git SSL Verification Disabled",
      "message": "Git is configured to skip SSL certificate verification...",
      "path": "git-config:http.sslverify"
    },
    {
      "id": "ssh-private-key-rsa",
      "probe": "ssh",
      "severity": "critical",
      "title": "Unencrypted SSH Private Key Detected (RSA)",
      "message": "An unencrypted RSA SSH private key was detected...",
      "path": "file:/Users/dev/.ssh/id_rsa"
    }
  ]
}
  • Probes : small, hermetic modules that scan specific areas of the system.
  • Detectors : reusable secret detection patterns used by probes.
  • Collector : orchestrates probes with timeouts and resource caps.
  • Reporters : render JSON or table output; emit exit codes for CI.

Each probe declares its scope (user/system), paths touched, env vars read, and risk rules it can emit.

Probe Description What it checks
git Git configuration security SSL verification disabled, SSH config issues (StrictHostKeyChecking, UserKnownHostsFile), plaintext credential storage ( credential.helper=store ), dangerous protocols (ext, fd, file), fsck disabled, proxy settings, custom hooks path
ssh SSH configuration and key security StrictHostKeyChecking=no ,UserKnownHostsFile=/dev/null ,ForwardAgent=yes , private key file permissions, unencrypted private keys
npm NPM/Yarn configuration .npmrc and.yarnrc files:strict-ssl=false , HTTP (non-HTTPS) registries,always-auth settings
env Environment variables and dotfiles Environment variables, shell config files ( .bashrc ,.zshrc ),.env files for embedded secrets
shell_history Shell history files .bash_history ,.zsh_history for secrets in command history
cloud Cloud provider credentials AWS ( ~/.aws/config ,~/.aws/credentials ), GCP (~/.config/gcloud/ ), Azure config files
jetbrains JetBrains IDE configuration JetBrains IDE workspace files and configuration for embedded secrets
gh GitHub CLI GitHub CLI authentication tokens and configuration
ai_cli AI CLI tools Credential files and chat logs for Gemini, Codex, Claude, and OpenCode
Detector Description Patterns detected
github-token GitHub authentication tokens Classic PAT ( ghp_ ), Fine-grained PAT (github_pat_ ), OAuth (gho_ ), App User-to-Server (ghu_ ), App Server-to-Server (ghs_ ), Refresh Token (ghr_ )
npm-token NPM authentication tokens NPM auth tokens ( npm_* )
ai-service AI service API keys OpenAI ( sk- ), Anthropic (sk-ant-api03- ,sk-ant-admin01- ), Hugging Face (hf_ ,api_org_ )
http-authentication HTTP auth credentials Bearer tokens, Basic Auth headers, API key headers ( X-API-Key , etc.), Basic Auth in URLs (http://user:pass@host )
ssh-private-key SSH private keys RSA, DSA, EC, OPENSSH, PKCS8 keys; detects encrypted vs unencrypted
cloud-credentials Cloud provider credentials AWS Access Key ID ( AKIA* ,ASIA* , etc.), GCP API Key (AIza* ), Azure Storage Account Key
generic-api-key Generic secrets High-entropy strings matching common secret patterns (uses Shannon entropy analysis)
jwt JSON Web Tokens JWT tokens ( eyJ prefix with standard JWT structure)
OS Support
macOS (Intel & Apple Silicon) Full support
Linux (x86_64 & ARM64) Full support
Windows (x86_64) Full support with platform-specific file paths and PowerShell history

All probes work cross-platform with appropriate path handling for each OS.

Fork addition -- not in upstream Bagel.

bagel scrub removes credentials from AI CLI session logs and shell history files, replacing them with [REDACTED-<type>] markers while preserving conversation context.

bagel scrub

bagel scrub --yes

bagel scrub --dry-run

bagel scrub --yes --grace-minutes 0

bagel scrub --yes --file ~/.claude/projects/foo/abc123.jsonl
Flag Default Description
--yes /-y false Skip confirmation prompt and apply changes
--dry-run false Scan and report only, do not modify files
--grace-minutes 60 Skip files modified within this many minutes
--file Scrub a single file instead of all eligible files

Targets:

  • ~/.claude/projects/**/*.jsonl -- Claude Code session logs
  • ~/.claude/projects/**/*.txt -- Claude Code tool results
  • ~/.codex/sessions/**/*.jsonl -- Codex CLI session logs
  • ~/.gemini/tmp/*/chats/*.json -- Gemini CLI chat logs
  • ~/.local/share/opencode/**/*.json -- OpenCode session logs
  • ~/.bash_history -- Bash shell history
  • ~/.zsh_history -- Zsh shell history
  • ~/.sh_history -- Generic shell history
  • ~/.local/share/fish/fish_history -- Fish shell history

Recommended workflow:

  1. bagel scan -f table -- assess your exposure
  2. bagel scrub --yes -- clean up
  3. bagel scan -f table -- verify reduction
  4. Rotate any credentials that were found

  • CI : runbagel scan --strict in your pipeline to fail builds when findings are detected.

  • Fleet-wide deployment : for enterprise-grade deployment at scale with centralized posture reporting across your developer laptop fleet, seeBoostSecurity DEP .

  • 0 – success, no findings detected (or--strict not set)

  • 1 – runtime error

  • 2 – findings detected (when using--strict )

Does it read my secrets? No. It only gathers metadata and security‑relevant flags.

Is it noisy? Probes are read‑only, batched, and time‑boxed to keep scans under a minute on typical dev machines.

source & further reading
github.com — original article I found an API key leak in MLflow, and why your AI agent may have one too Show HN: An audit for AI agents headed into air-gapped networks Show HN: Klad, a paint app your coding agent can drive (source-available)
── more in #developer-tools 4 stories · sorted by recency
── more on @boostsecurity 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/bagel-is-a-cross-pla…] indexed:0 read:8min 2026-11-11 · —