Confessor reconstructs what Claude Code actually touched

Confessor is a new console tool that parses session logs in ~/.claude/projects to rebuild what an agent did: which files it opened, which commands it ran, which secrets landed in context, and where data could have gone. It flags one pattern in particular: reading a sensitive file followed by a network call in the same session.

In the sample report, the agent read a .env with three keys, then fifteen seconds later ran a curl that shipped the file to an outside host. The author is clear that this isn’t proof of theft, just a reason to check.

The detector is rules-based: 30 secret patterns, 13 structured-data patterns, and 7 topical dictionaries. It makes zero network requests itself. Run it with npx confessor. MIT licensed.