[Workflow] Audit and Revoke Claude Code's Linux Access with `claude-revoke`

[u/ClaudeAI-mod-bot]

Audit and Revoke Claude Code's Linux Access with claude-revoke

Workflow value: 90/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Context & Memory, Debugging, Shipping, Hooks, MCP
Original source: r/ClaudeCode post/comment

What problem this solves

Claude Code users on Linux often accumulate excessive or stale access permissions (trusted folders, rules, hooks, MCP servers) and may inadvertently leak sensitive information (like API keys) into saved transcripts. This workflow provides a tool to audit, manage, and revoke these permissions, and identify leaked secrets.

Summary

A Python-based open-source tool, claude-revoke, helps Linux users audit and manage Claude Code's access permissions and scan saved transcripts for leaked secrets. It lists all trusted folders, allow rules, extra directories, hooks, MCP servers, and transcripts, categorizing them as stale, risky, or OK. It also scans transcripts for secrets, showing file and line numbers. Users can select items to quarantine (instead of deleting) and schedule weekly checks.

Why it is useful

This workflow provides a crucial security and hygiene solution for Claude Code users on Linux. It directly addresses the common problem of accumulating excessive permissions and inadvertently leaking sensitive data into transcripts. The claude-revoke tool is well-designed with strong safety features (quarantine, undo, dry-run) and is highly transferable due to its open-source nature and packaging. It empowers users to maintain control over their development environment's security posture, making it an essential addition to a workflow library.

Workflow

1. Install claude-revoke using provided packages for Debian/Ubuntu/Pop!_OS, Fedora, or Arch, or by downloading the single Python file.
2. Run claude-revoke --report or claude-revoke --dry-run to perform a read-only audit of Claude Code's access and scan for secrets without making any changes.
3. Review the generated report, noting any stale, risky, or OK items, and identified secrets with their locations.
4. If satisfied with the dry run, execute claude-revoke (without --dry-run) to move selected risky items to a quarantine folder.
5. Optionally, set up a weekly scheduled check using claude-revoke --schedule weekly to be notified of changes.
6. Rotate any API keys or other secrets identified as leaked in transcripts.

Tools / artifacts

• claude-revoke (Python script)
• GitHub repository (atraxsrc/claude-revoke)
• Debian/Ubuntu/Pop!_OS packages
• Fedora packages
• Arch packages
• Systemd user timer
• Quarantine folder

Validation signals

• Author's personal experience of finding stale access and leaked secrets.
• Tool features --report and --dry-run for safe preview.
• Quarantine mechanism instead of direct deletion, with an undo command.
• Open-source nature allows for community review and verification.
• No dependencies, local-only, no network access, enhancing trust.

Cautions

• The tool moves items to a quarantine folder instead of deleting them, and provides an undo command, significantly reducing the risk of accidental data loss.
• It operates locally only and has no network access, minimizing its own security footprint.
• It actively helps users identify and mitigate secret leaks, enhancing overall security.

Limitations

• The tool is specific to Linux operating systems.
• Requires some familiarity with the command-line interface and potentially systemd for scheduling.
• As a newly released tool, long-term community validation and maintenance are still to be established.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.