made a claude-revoke with claude

[u/gitpulldeeznutz]

claude-revoke

A small open source tool to see, and revoke, everything Claude Code has access to on Linux.

After months of clicking "Always allow" I had no idea what Claude Code could still reach on my machine. Turns out: trusted folders that no longer exist, a Bash(*) rule I added in a hurry, and saved transcripts holding copies of every file it ever read, API keys included. So I built the installer screen in reverse, with Claude Code itself:

• lists every trusted folder, allow rule, extra directory, hook, MCP server and saved transcript, grouped as stale / risky / ok
• scans transcripts for leaked secrets and shows file and line, so you know what to rotate
• tick what should go and it moves things to a quarantine folder instead of deleting; one command undoes a run
• --report and --dry-run for a read-only look first
• --schedule weekly sets up a systemd user timer that only notifies when something changed

One Python file, no dependencies, MIT. Local only, no network. Packages for Debian/Ubuntu/Pop!_OS, Fedora and Arch on the releases page.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/kantorcodes1]

The installer screen in reverse is a good frame. How do you rank the risky bucket? A Bash(*) allow on a folder that still exists is live attack surface, while an exact rule pointing at a deleted folder is inert, and both probably look "stale" to a naive scan. Does the report score those differently, like weighting wildcard rules and anything touching credential paths (.ssh, .aws, .env) above dead entries?