weir

ool results before the model sees them. Setup is weir statusline setup, on Linux and macOS for now. So the two modes are deliberately different: Build: plant → run → prove where the credential went. Use: observe → warn → optionally redact before the model sees it. The test mode is deterministic and offline. On Linux it can also run the agent without outside network access, so direct exfiltration attempts are caught. If a required path wasn't exercised, Weir reports incomplete, never clean. It doesn't try to detect every possible secret. It matches known whole values, so hashed, split, truncated, or otherwise transformed credentials aren't covered. The Claude Code hook only protects the tool-result boundary: it can't undo a credential already pasted into the conversation, and a failed command's output reaches the model as is. Apache-2.0, no model in the loop, and Weir itself sends nothing anywhere. It found GHSA-j7qq-vr8c-xvw3 in MLflow (fixed in 3.17.0). Built with AI assistance; every security finding was reproduced before I reported it.