Blackhount Agent Check

Install and run

Run locally with npx. Nothing is uploaded unless you enroll to Watch.

npx --yes --package=https://blackhount.com/downloads/blackhount-agent-check.tgz blackhount-agent-check

# Machine-readable
npx --yes --package=https://blackhount.com/downloads/blackhount-agent-check.tgz blackhount-agent-check --json

# Local HTML report (stays on your machine)
npx --yes --package=https://blackhount.com/downloads/blackhount-agent-check.tgz blackhount-agent-check --report ./agent-check-report.html

Supported detection targets: Claude Code, Claude Desktop, Cursor, Codex, and common MCP configuration files on Windows, macOS, and Linux.

What it reads, and what it never does

Reads

• Known agent/MCP configuration file locations
• Declared commands, args, URLs, filesystem scopes
• Environment variable names
• Whether common credential paths exist

Never

• Uploads secrets or telemetry by default
• Reads or displays secret values, private keys, or tokens
• Executes MCP servers or arbitrary agent commands during discovery
• Requires a Blackhount account for a basic scan

To enable continuous monitoring, create an enrollment token in Watch Agents, then run Agent Check with --enroll. Only redacted metadata is sent.

Want continuous monitoring?

Create an enrollment token in Watch, then enroll this machine for continuous Agent Security monitoring.

Related

• Agent Security: continuous monitoring
• Blackhount Watch: External + Agent Security
• Watch solutions
• Open Agents in Watch