After the agent-tool breach, I asked: where do my API keys actually live?

A few days ago, an agent-tool vendor disclosed a breach that exposed
provider API keys stored in its console workspaces. My first thought
wasn't about their infrastructure. It was much more embarrassing:

Which keys do I even have, and where are they stored?

I couldn't answer that in under a minute. And I suspect most developers
can't. A provider key gets pasted into one agent tool's config, then
another's, then an .env file, then shell history — and every copy is
another place it can leak from, and another line on the bill if someone
abuses it.

So I built a small tool that answers the question locally: keymap.

What it does

One command, no dependencies, no network:

python -m keymap

It scans the config files your agent tools, CLIs and shells actually
read — ~/.claude.json, ~/.codex/config.toml, ~/.env, shell rc
files and history, ~/.aws/credentials, and friends — and reports:

where each provider key sits (Anthropic, OpenAI, Google, GitHub, AWS, Slack, Stripe — plus anything assigned to a *_API_KEY / *_TOKEN / *_SECRET variable it doesn't recognise),
whether the same key is sprawled across files,
whether its file is world-readable (chmod 600 it),
whether it landed in shell history,
whether it's one careless git add . away from a commit — or already tracked.

It finishes with a rotation checklist: the exact revoke page for every
provider it found. After a vendor breach, that's the difference
between a scavenger hunt and a checklist.

What it never does

Never prints key material. Reports show only the public prefix (sk-ant-…) plus a SHA-256 fingerprint prefix, so you can recognise the same key across files without seeing it.
Never sends anything anywhere. No network, no telemetry.
Never writes. Read-only. It tells you what to fix; you fix it.

Try it on a fake home first

The repo ships examples/demo-home/ — a fake home with the same
Anthropic key in two files, an OpenAI key in .env and shell
history, a GitHub token, and a world-readable .env: