AIHound: An Open Source Tool for Finding AI Credential Exposure
As AI coding assistants become part of everyday development workflows, a new security blind spot has emerged: credentials stored in plaintext on your local machine.
Tools like Claude Code, Cursor, Continue.dev, and Cline need to authenticate with external services — and many of them store OAuth tokens, API keys, and MCP server credentials in predictable JSON files on disk. One read operation can expose tokens for GitHub, Azure DevOps, Slack, databases, and more.
What is AIHound?
AIHound is an open source tool that scans your system for AI-related credential exposure. It checks the well-known paths used by 14+ popular AI tools across Windows, macOS, and Linux, and reports what’s stored in plaintext.
What it looks for
- OAuth access and refresh tokens (Claude Code, Copilot, and others)
- API keys in config files (Continue.dev, Cline, Cursor)
- MCP server credentials aggregated in a single config file
- World-readable files, especially in WSL environments
- Long-lived CI/CD tokens (
CLAUDE_CODE_OAUTH_TOKENand equivalents)
Background
Recent research across 14 AI desktop tools found that nearly 48% of MCP server implementations recommend plaintext credential storage. A single compromised file can cascade into access across every connected service. On WSL, credential files inherited from Windows mounts often have 0777 permissions — world-readable by any process on the system.
For the full breakdown of attack scenarios and credential storage locations across tools, see the blog post: AI Coding Assistant Credential Storage Risks
Some quick mitigations
chmod 600your credential files- Use env var references in MCP configs instead of inline tokens:
"GITHUB_TOKEN": "${GITHUB_TOKEN}" - Add
.mcp.jsonto.gitignoreif it contains secrets - Disable VS Code Settings Sync if you use Cline with MCP servers
- Avoid
--dangerously-skip-permissionson machines with real credentials
Try it out and drop your feedback below!