datapce-scan

Read-only, local, nothing sent, no command text printed.

datapce-scan counts what a coding agent ran, from the agent logs already on your disk. It also replays public block lists over your past commands and counts what each list would have denied. Four more commands check allow rules, secret-file reads and hook runs. Nothing installs into the agent. The tool does not block, change or send anything.

Home: https://github.com/jurikern/datapce-scan (mirror: https://codeberg.org/datapce/datapce-scan)

Quick start

uvx datapce-scan
uvx datapce-scan replay --rules all

The package is on PyPI as datapce-scan (pipx run datapce-scan also works). From the repository: uvx --from git+https://github.com/jurikern/datapce-scan.git datapce-scan. From a local checkout: uvx --from . datapce-scan.

Python 3.9 or later. No dependencies outside the Python standard library.

What it reads and what it prints

Commands

Common options: --projects DIR, --include-subagents, --since YYYY-MM-DD, --until YYYY-MM-DD, --json, --tsv.

Show local family names (off by default)

WARNING: --show-local-families prints every command family name. The names can include private script or tool names. Do not share that output.

datapce-scan --show-local-families shows all family names. The output starts with a WARNING line.

datapce-scan allow-suggest --show-local-families also suggests rules for programs that are not on the public list. The rule text can show private script names. The output holds a WARNING line.

Show examples (off by default)

WARNING: --show-examples prints command text from your own logs. Do not share or paste that output. The tool masks e-mail addresses and secret-like values, but other private text can show.

datapce-scan replay --rules sage --show-examples 3 prints up to 3 matched commands for each rule. It works only in the table format and only when the output goes to a terminal, not to a pipe or a file.

Packaged rule sets

Each rule-set file records the source URL, the upstream commit, the licence and the fetch date (2026-10-22). See src/datapce_scan/rules/NOTICE.

Measures

How the matcher reads a command: a real shell tokenizer (shlex) splits the command. The matcher looks inside bash -c, sh -c, eval, $( ), backticks, <( ) and find -exec. It removes sudo, env, nohup, timeout, xargs and similar wrappers. rm -fr, rm -rf and rm -r -f are the same. / is the root directory only, not every absolute path. Text and regex rules from public lists (Sage, Cupcake) run on the whole command text, as the source tools do.

Sample output (synthetic data)

datapce-scan 0.2.0 | read-only, local, nothing sent, no command text printed

Source: Claude Code transcripts, 3 files, 2026-10-20 to 2026-10-21 (UTC), subagents not included

Totals
  tool calls                                       9
  Bash calls                                       7
  simple commands in Bash calls                    9
  sessions                                         3
  active hours (UTC clock hours with a tool call)  3
  days                                             2

Tools  [calls, share]
  Bash  7  77.8%
  Edit  1  11.1%
  Read  1  11.1%

Bash command families (first word)  [calls, share]
  git         3  33.3%
  rm          2  22.2%
  bash        1  11.1%
  cd          1  11.1%
  curl        1  11.1%
  (other: 1)  1  11.1%

datapce-scan 0.2.0 | read-only, local, nothing sent, no command text printed
Replay: what each rule set would have done to past Bash calls. Nothing was blocked; this is a count.

Rule set: datapce-6  (6 rules; licence own work (datapce); datapce guard v0; fetched 2026-10-22)
  Bash calls                                                 7
  Bash hours (UTC clock hours with a Bash call)              3
  denies                                                     2
  asks                                                       0
  denies per Bash hour                                   0.667
  denies with a temp-dir target (likely false)        0 (0.0%)
  denies that match heredoc text only (likely false)  0 (0.0%)
  denies by rule  [denies, temp-dir target, heredoc text only]
    git-push-force  1  0  0
    rm-rf-root      1  0  0

Limits

1. Claude Code logs only. Codex and other agents are not read in v0.
2. A replay is a count from text. It does not run commands and does not know what a command did.
3. The cc-safety-net set is a paraphrase. It does not model secret-file rules, pipe-to-shell, the temp-repo and worktree relaxations, or rulebook packs. Its counts can differ from the real tool.
4. The sage set does not model trusted-domain suppression, URL checks or package checks. Actions use the Sage default "balanced" thresholds.
5. The cupcake-examples set holds example policies, not Cupcake defaults.
6. The shell parser does not expand variables, aliases or functions. It follows a variable only when the same call sets it to a literal value or to a mktemp result. A quoted operator (for example ";") splits a command.
7. "Temp-dir target" and "heredoc text only" mark likely false denies. They are not a full count of false denies.
8. A command family is the basename of the first word. Names that are not on the public list are counted, but not named, unless you use --show-local-families.
9. Times are UTC.
10. allow-suggest counts the past calls that a rule matches. The Claude Code docs do not say that an allow rule stops a "no verdict" block when the server reviews the session.
11. allow-audit and hook-runs read the settings files as they are now. The calls and hook runs are past.

Development

python3 -m unittest discover -s tests -t .

The tests use synthetic transcripts only. CI: .forgejo/workflows/test.yml runs the suite on Python 3.9 and 3.13 (NOT MEASURED: not run until the first push).

Licence

MIT, see LICENSE. The third-party rule data keeps its own licences (MIT, Apache-2.0, DRL-1.1); see src/datapce_scan/rules/NOTICE.