Show HN: Weir – Catch credential leaks in the AI agents you build and use

Category: security

Tags: security, ai-agents, credential-scanning, llm-observability, ci

Score: 7.0/10 (Innovation: 7, Technical: 7, Documentation: 8, Utility: 6)

Weir is a canary-based credential leak scanner for AI agents: it plants fake keys in place of real ones, runs the agent's flows against a local fake model, and checks all egress (spans, logs, metrics, prompts, service calls) for the exact planted values, yielding leak/clean/incomplete verdicts. It also ships a Claude Code status line and redaction hook that counts real credentials entering the session and strips known keys from tool results. It found a real MLflow advisory (GHSA-j7qq-vr8c-xvw3), and the deterministic, offline design plus explicit limits make the approach credible.

Target audience: AI/agent developers, security engineers, platform/DevOps teams, Claude Code users

Repository: https://github.com/IdoGol24/weir · Python · Apache-2.0 · 17 stars

View on Hacker News