Key Census: find, cap and rotate the LLM keys your agent tools hold
A CLI that lists every LLM API key held by your coding-agent tools and swaps them for capped proxy keys. Developers pay.
Crowded · OpenCode console breach leaks API keys
Written for: Solo builder
Next step
This week, ship the scan-only keycensus CLI (no network calls, covers the major coding agents plus .env files and git history) and post it as a reply in the OpenCode breach threads on Hacker News and r/LocalLLaMA.
Why now
Rotating keys is manual, and most developers can't say which of their five agent tools holds which provider key. A distillation attacker burns a stolen key at high volume, so the first sign is usually the bill. This is a different card from Blast Radius (what a deployed agent's cloud credentials can reach) and Egress Leash (sandbox network egress). The gap here is the developer's own model-provider keys sitting inside third-party agent tools, across every provider at once. Providers offer project keys and budgets one at a time. Nobody shows the whole picture across tools.
What became possible
Not a technical breakthrough but a breach. Anomaly Innovations says an attack it calls a 'large scale distillation attack' reached about 1.4% of OpenCode Console users and exposed the OpenAI keys they had stored. Threads on Hacker News and r/LocalLLaMA are telling everyone to rotate their keys. Separately, rogue agent activity reported in India got in through credentials left in app configs, public repos and overly broad cloud roles.
Three ways in
- keycensus CLI (open source)
Scan-only, offline. Reads common agent-tool config locations, .env files, shell rc files and git history for OpenAI, Anthropic, DeepSeek and OpenRouter key patterns. Prints a table of tool, provider and last four characters, with a direct link to each provider's rotation page.
- Customer
- Individual developers running three or more coding agents
- Model
- Free open-source CLI that feeds the paid relay
- Capped relay keys
A hosted relay that issues a separate key per tool, each with a daily spend cap, a model allowlist and a one-click kill switch. It flags distillation-shaped traffic: sustained high volume, unusual hours, long batches of near-identical prompts.
- Customer
- Freelancers and 2–10 person dev teams sharing provider accounts
- Model
- $8/month individual, $5/seat team, self-serve
- Spend-spike alerts
Read-only polling of provider usage endpoints, with alerts to email or Slack when spend jumps above the user's normal pattern.
- Customer
- Indie hackers on pay-as-you-go API plans
- Model
- Free tier for one provider, $4/month for all
Competition
Each piece of the idea already exists on its own. Several free tools (arkna-scan, MCP Audit, AgentShield, DeepSafe, Snyk Agent Scan) scan agent configs for keys, and Gitleaks and TruffleHog cover git history.
Full competition notes (16 competitors)
Each piece of the idea already exists on its own. Several free tools (arkna-scan, MCP Audit, AgentShield, DeepSafe, Snyk Agent Scan) scan agent configs for keys, and Gitleaks and TruffleHog cover git history. Capped keys per tool are standard in LiteLLM, Bifrost, Agentgateway and ProxAI, and OpenRouter offers them natively for free. Spend alerts have several indie launches (TryTokka, AICostPass, llm-cost-guard), so that market is cheap and easy to copy. What I did not find is one tool for solo developers and small teams that inventories the keys each coding agent (Claude Code, Cursor, Codex, Aider and so on) holds, issues a capped replacement key or OpenRouter sub-key for each, rewrites that tool's config or base URL to use it, and walks the user through rotating the original key. The existing gateways assume someone will run infrastructure, and the existing scanners stop at a report. A new entrant could win on that end-to-end flow and a fast setup across many agent tools. Detecting distillation-shaped traffic is also unclaimed, but it mostly protects model providers rather than the developers who would pay, so it is unlikely to drive purchases. A hosted relay also has to win trust to hold users' provider keys, which is a real barrier when free self-hosted gateways and OpenRouter's built-in caps already exist. One thing I did not verify: whether Anthropic and OpenAI now offer spend limits per workspace or project in their own consoles, which would weaken the relay further.
- LiteLLM Proxy (virtual keys)
Open-source gateway whose virtual keys carry dollar caps that reset daily or monthly (max_budget, budget_duration), per-model budgets, fallback models and team limits. It has a documented setup for routing Claude Code through it. This already covers most of the capped relay key idea.
- Bifrost by Maxim AI
Open-source Go gateway with budgets and rate limits per virtual key, per team and per customer.
- Agentgateway
Open-source gateway with virtual keys, token and dollar budgets per key that refill on a schedule, and keys stored hashed.
- ProxAI
Self-hosted AGPL reverse proxy, shipped as a single Go binary, sold as an LLM budget kill switch. It enforces hourly or daily spend caps per client and only needs a base-URL change.
- OpenRouter per-key credit limits
Built into the provider: each OpenRouter key can have its own spending cap, with daily, weekly and monthly usage visible through the key endpoint. This gives a separate capped key per tool at no cost.
- arkna-scan
npm CLI that detects agent tools such as Claude Code and Cursor, plus LLM providers, by scanning .env files, configs and source code, with a deeper machine-wide mode.
- MCP Audit
Scans the configs of Claude Desktop, Cursor, VS Code and Windsurf for exposed secrets and AI models.
- AgentShield
Local scanner (run with npx) that reads ~/.claude and grades its security.
- DeepSafe Scan
Static security scan for Claude Code, Cursor and Codex that runs locally with no API key.
- Snyk Agent Scan
Snyk's scanner for agent configs. It has a local CLI mode and a background mode that contacts Snyk.
- Gitleaks
Standard open-source secret scanner that checks files and git history. Detects OpenAI and Anthropic key patterns (from my own knowledge, not these searches).
- TruffleHog
Widely used secret scanner that checks git history and verifies whether found keys still work, including LLM provider keys (from my own knowledge, not these searches).
- TryTokka
Indie spend monitor for OpenAI, Anthropic, Gemini and OpenRouter. Syncs daily, emails when a spending limit is crossed, and breaks spikes down by model.
- AICostPass
Monitors OpenAI and Anthropic spend and emails when budget thresholds are crossed. Slack and Discord alerts are planned.
- llm-cost-guard
Wrapper around the Anthropic, OpenAI and Gemini client libraries that hard-stops requests over budget and sends Slack or Discord webhook alerts.
- RelayShield
Free check for whether a domain's LLM provider keys appear in data stolen by infostealer malware, available as an API and MCP server. Aimed at stolen-key abuse (LLMjacking), not at spotting distillation patterns.
Checked 2026-10-18
Risks
- Providers already offer project-scoped keys and budget limits, and could add per-tool keys natively
- A relay that holds keys concentrates the same risk it is meant to reduce, so one breach ends the product
- OpenRouter-style gateways already cover part of the relay idea
- Breach attention fades within a week or two, so launch speed matters more than polish
Strong tech readiness and team fit; open space is the weak point (5).
tech 9 · pull 6 · space 5 · fit 9 · build 9
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Anomaly Innovations, behind coding agent OpenCode, says a breach hit ~1.4% of OpenCode Console users and their API keys, in a "large scale distillation attack" (Walter Schulze/Startup Fortune)Techmeme
- OpenCode Hacked: User credentials leakedHacker News
- Opencode breached, rotate keys to be safe.r/LocalLLaMA
- India becomes the latest country to report rogue AI agent activityTechCrunch AI
Status history
- 2026-10-18 Flagged as buildable