Netwrix, a cybersecurity vendor with more than 20 years of experience, has introduced AIHound — a free open-source tool designed to identify API keys, OAuth tokens, and other credentials that may remain on workstations after developers use popular AI coding assistants.
Why does it matter?
The rise of AI assistants has created a new cybersecurity challenge for software development organizations. Tools such as Claude Code, Cursor, Continue.dev, Cline, and GitHub Copilot require access to external services. They often store authentication tokens, API keys, and MCP server credentials in local files. Nearly 48% of MCP server implementations storing credentials in plaintext. For attackers, this can significantly simplify the compromise of corporate resources if they gain access to a developer’s machine.
How does it work?
AIHound scans common storage locations used by more than 14 popular AI tools across Windows, macOS, and Linux. The solution can identify OAuth tokens and API keys, MCP server credentials, secrets stored in configuration files, and insecure file permissions that may expose sensitive data to other users or processes. The exposure of such information could result in unauthorized access to GitHub, Azure DevOps, Slack, databases, and other services integrated with AI tools.
One of AIHound’s key capabilities is its integration with BloodHound, including the Community Edition. BloodHound helps security teams analyze relationships between accounts, privileges, and digital assets, effectively identifying potential attack paths. Once scan results are imported into BloodHound, the visualization highlights all connections between AI services, MCP servers, and data repositories, providing an immediate assessment of the potential impact of a compromised token or key.
For analysis purposes, AIHound builds a dedicated object graph. It includes credentials, AI services, MCP servers, configuration files, environment variables, network endpoints, and data stores. Within BloodHound, this enables organizations to perform blast radius analysis, identify excessive file permissions, and detect duplicated secrets.
Summary
AIHound is a ready-to-use risk assessment tool for evaluating the security implications of locally stored credentials within AI copilots and MCP infrastructure. The project is available free of charge on GitHub.
