heldkeys: list credentials your coding agent can reach
At a glance
Read-only CLI that inventories env/CLI/.env/MCP/SSH/cloud logins an agent inherits on laptop, sandbox, or CI—and flags risky agent steps in GitHub Actions—without printing secret values. This workflow is listed under agent-security, credentials, ci, mcp-config, threat-model.
Agents / tools
heldkeys, Claude Code, Codex, Cursor, GitHub Actions
Show HN (Oct 17): RugSnare pins each MCP tool's {name, description, inputSchema} by canonicalized SHA-256 at install, then diffs upgrades across 24 popular servers (~3.6M weekly installs)—336 contract changes found; grades BREAKING/LOOSENED/EXPANDED/NOTATION/COSMETIC and exits 1 for CI. Apache-2.0, zero npm deps; OWASP MCP Security Cheat Sheet now recommends contract pinning.
Local gate: one policy set so Claude Code/Codex/Cursor check with Paveo before shell or file write; dangerous actions refused, every decision logged—no network required.
Remote MCP at anaconda.com/api/mcp returns package facts, curated CVEs, org channel policy, and forum hits so Claude Code/Cursor/Codex/Kilo check real conda names and vulns before proposing installs—server cannot mutate your machine; agent still runs conda under your permissions.
Marc Lou’s MailCheap exposes Streamable HTTP MCP at https://mailcheap.ai/mcp so ChatGPT, Claude and Grok Bot connect with OAuth (no key to copy); Claude Code, Codex and Cursor use a bearer API key. Agents can draft campaigns, send tests, schedule issues and read stats; schedule/send tools are marked destructive and ask before sending. Open-source / self-host option; pay only for SES-style sends vs beehiiv-class plans.