API key leak detection for the agents you build and the coding agent you use. Test any agent with planted fake keys, or see which of your real keys a Claude Code session exposed.

Agent frameworks can copy keys into traces and logs, and coding agents can read them into the model's context. Weir finds each key by its exact value, names where it went, and never prints it.

The agents you build: plant fake keys where your real ones live, run the agent's own flows, and get a verdict for every place they reached: spans, logs, console output, the model, other services. Leak, clean or incomplete. It found GHSA-j7qq-vr8c-xvw3 in MLflow.

The coding agent you use: in Claude Code, a status line shows which of your real keys entered the session or left in a tool call, and an optional hook strips known keys from tool results before the model reads them.

Repo: github.com/IdoGol24/weir .…