Workspace Sweep: scan what your agent will read, and what the last session left behind

Each piece of this already exists for free. Hidden-Unicode and rules-file scanning are covered by ctxsentry, CodeSafer, the claude-mods script and Snyk Agent Scan. Runtime injection warnings come from lasso claude-hooks. Memory baselining and diffing come from bastionmemory and the OWASP Agent Memory Guard. Hidden text in PDF and DOCX is caught by Hidden Text Detector and DocFirewall, with Superagent selling it as an API. Snyk gives away the best-known agent config scanner, which makes it hard for individual developers to pay a subscription for detection logic alone. I did not find one product that combines everything sweep hooks proposes. That means hashing all agent-writable paths at SessionEnd, not just memory files, then diffing and scanning at SessionStart, across Claude Code, Codex and Cursor together. A new entrant could still win on integration and polish: one install that hooks all three agents, low false positives, a clear way to review and approve changes, and a fully local design for developers who won't send their configs to Snyk's cloud. Folder Sweep is the more open of the two ideas. The existing document scanners are CLIs or APIs, and I found no friendly desktop app that scans a Drive or Dropbox folder for non-technical consultants. Hidden Text Detector's open-source detection could be wrapped in one quickly, though. The main risk is that Anthropic, Cursor or OpenAI build integrity checks into their agents. The memory-poisoning exploit that Anthropic patched in Claude Code v2.1.50 shows the vendors are paying attention, and a built-in feature could shrink the market to a small premium tier or turn it into an open-source project.

• Snyk Agent Scan (formerly Invariant mcp-scan)

  Free CLI that finds the MCP configs and skills on a machine for Claude Code, Cursor, Codex, Windsurf, Gemini CLI and others. It checks them for prompt injection, tool poisoning and hardcoded secrets. Scans run through Snyk's hosted service and need an API token. It does not diff between sessions and does not inspect documents.

• lasso-security/claude-hooks

  Open-source Claude Code PostToolUse hook. It pattern-matches file reads, web fetches and command output for planted instructions and adds a warning to the agent's context. It runs when content is read, not before the session starts.

• ctxsentry

  Static scanner with no dependencies. It checks an untrusted repo's README.md, CLAUDE.md and .cursorrules for injection payloads before a coding agent reads them. This is close to the scan half of sweep hooks.

• CodeSafer (goldmembrane/cleaner-code)

  MCP server that detects invisible characters, bidi tricks, homoglyphs and rules-file backdoors. It includes a scan_rules_file tool for AI config files.

• prompt-injection-defense skill (claude-mods)

  Free skill that ships a scan-hidden-unicode.py script. It audits CLAUDE.md and SKILL.md for tag characters and zero-width characters.

• bastionmemory

  Open-source scanner for agent memory poisoning (OWASP ASI06). It flags directives disguised as facts and diffs memory against a baseline to catch poison that appears over time. This is the closest match to the hash-and-diff idea in sweep hooks.

• OWASP Agent Memory Guard

  OWASP reference runtime layer that screens agent memory reads and writes for injection markers and changes to protected keys. Per an OpenHands issue, its design includes SHA-256 integrity baselines for catching tampering after a write.

• Super Agent Memory (SAM)

  Shared memory layer for Claude Code, Codex, Cursor and others. It uses SessionStart, Stop and PreCompact hooks, and its README says its guard quarantines poisoned notes written by agents. It is not a dedicated security product.

• Hidden Text Detector

  MIT-licensed CLI and Agent Skill. It finds white-on-white text, tiny fonts, off-page text, Word's hidden attribute and Unicode tag characters in PDF and DOCX. This overlaps directly with Folder Sweep.

• DocFirewall

  PDF scanner that finds hidden text and runs a prompt-injection classifier. It returns a BLOCK verdict before content reaches the model.

• Superagent

  Commercial API guardrail that scans uploaded files, including hidden text, metadata and OCR output, for jailbreak instructions before an agent sees them.

• Telnyx AGENTS.md scanner tutorial

  Published tutorial showing developers how to build their own LLM-assisted scanner for AGENTS.md and CLAUDE.md. A do-it-yourself version is easy to make.

Checked 2026-10-12