How to audit AI coding assistant tokens and config files: Find, rate and fix stored credentials

Every AI coding assistant on a developer laptop holds at least one credential, and several of them can fall back to a plaintext file or read a token from an environment variable that quietly overrides the one you intended. Those tokens reach model APIs, GitHub, cloud accounts and every MCP server the assistant is configured to call, so a stolen laptop profile or a malicious extension can turn them into direct access. This runbook lists where Claude Code, GitHub Copilot CLI, OpenAI Codex, Gemini CLI, VS Code and Cursor store credentials and configuration, how to check each location without exposing the secret, how to rate what you find, and how to move to safer storage with a rollback. It is for endpoint, platform and application security teams auditing developer machines. For the wider strategy, see Developer endpoints as NHI stores; for permission and sandbox settings, see the AI IDE and Coding Agent Security Guide.

This is an independent guide from NHI Mgmt Group, based on each vendor's public documentation as of November 2026. It is not sponsored or reviewed by any vendor. These tools change monthly, so confirm paths and settings against current documentation before scripting them.

Key takeaways

• Know the fallbacks. Claude Code, Copilot CLI and Codex prefer the OS keychain but can write plaintext files: ~/.claude/.credentials.json, ~/.copilot/config.json and ~/.codex/auth.json.
• Environment variables win. Copilot CLI checks COPILOT_GITHUB_TOKEN, GH_TOKEN and GITHUB_TOKEN before its keychain token, and Claude Code ranks ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY above its own login. Shell profiles are part of the audit.
• Config files carry secrets too. MCP configurations (~/.claude.json, .mcp.json, .cursor/mcp.json, .vscode/mcp.json) and .gemini/.env files often hold literal API keys and bearer headers.
• Logout is not revocation. Copilot CLI's /logout removes the local token but does not revoke it on GitHub; revoke at the issuer as well.
• Enforce with managed settings. Claude Code's forceLoginMethod, forceLoginOrgUUID and allowedProviders, and Codex's forced_login_method and cli_auth_credentials_store, turn audit findings into policy.

When you need this

• Before or after rolling out an assistant: a baseline shows which login methods and storage modes are actually in use, compared with the approved one.
• After a malicious extension or package report: campaigns such as the JetBrains Marketplace AI plugin campaign, where fake AI coding assistants stole developers' AI API keys, and the TrapDoor supply chain campaign, which hunted developer credentials, show attackers going after the developer credentials these files hold.
• When a developer leaves or a laptop is lost: you need to know which tokens existed on that machine to revoke them. The Compromised Developer Workstation Playbook covers the incident side.
• For audit evidence: NIST SP 800-53 IA-5(7) asks that unencrypted static authenticators are not embedded in applications or stored in files; plaintext token files are the case it describes.

Where each assistant keeps credentials

Gemini CLI's own documentation states it was replaced by Antigravity CLI on 18 June 2026; machines that still run it should be in the audit and on a retirement list.

Before you start

• Do not collect secrets: the audit records that a credential exists, its type (from the prefix, such as gho_ or github_pat_), the file, its permissions and its owner. It never copies the value into a ticket, spreadsheet or log. Codex's documentation tells users to treat auth.json like a password and never paste it into tickets or chat.
• Use your endpoint tooling: run checks through EDR live query, MDM scripts or osquery with read-only scope, and report file paths, sizes, modes and modification times only.
• Agree the approved state per tool: for example, Claude Code via organisation login only, Copilot CLI via keychain OAuth only, Codex with cli_auth_credentials_store = "keyring", and no literal secrets in any MCP or .env file.
• Prepare revocation routes: know where each token type is revoked (GitHub Settings > Applications > Authorized OAuth Apps for Copilot CLI OAuth, the Claude Console and OpenAI platform for API keys) before you find anything. See How to audit OpenAI and Anthropic organisation API keys.

Step-by-step

Steps 1 to 5 are read-only. Steps 6 and 7 change configuration and are reversible. Step 8 revokes credentials and cannot be undone for that token.

1. Check for plaintext credential files. On each machine, test for the presence, owner and mode of ~/.claude/.credentials.json (and under any CLAUDE_CONFIG_DIR), ~/.copilot/config.json, ~/.codex/auth.json (and under any CODEX_HOME), and Anthropic profile files under ~/.config/anthropic. Claude Code writes its file with mode 0600; any group or world readable mode is a finding. On macOS, a Claude Code credentials file means a Keychain write failed at some point, so the token sits on disk instead.
2. Check environment and shell profiles. Search shell startup files (~/.bashrc, ~/.zshrc, PowerShell profiles) and user environment settings for the variable names in the table above, recording the name only. Gemini CLI's documentation warns that keys exported in a shell startup file are readable by any process launched from that shell. Also check the env block in ~/.claude/settings.json and .claude/settings.json, because Claude Code reads CLAUDE_CODE_OAUTH_TOKEN from there in every new session until it is removed.
3. Check the assistant's own view. Ask developers or a scripted session to run Claude Code's /status, which shows the active login method or profile, marks unused credentials, and lists Setting sources including any managed source. A long-lived token created by claude setup-token is valid for one year and is printed rather than stored, so look for it in CI variables and password managers as well as on the laptop.
4. Scan MCP and assistant config files for literal secrets. Check ~/.claude.json (Claude Code stores MCP server configurations there), project .mcp.json, ~/.cursor/mcp.json and .cursor/mcp.json, .vscode/mcp.json, the VS Code profile mcp.json and ~/.copilot/mcp-config.json. A value in env, headers or auth that is not a ${env:NAME}, ${NAME} or ${input:...} reference is a literal secret. VS Code's documentation is explicit that a personal configuration file is not a secret store. The How to audit MCP servers on developer laptops runbook covers the servers themselves.
5. Check repositories for committed assistant files. In source control, search for committed .claude/settings.local.json, .gemini/.env, .mcp.json and .cursor/mcp.json files containing literal values. Claude Code adds **/.claude/settings.local.json to the global git excludes only when it creates the file itself; a hand-made file is not protected. Use your secret scanner for the key formats, as in How to find LLM API keys in code and CI.
6. Move credentials to safer storage (reversible). For Codex, set cli_auth_credentials_store = "keyring", which fails rather than falling back when no store is available; administrators can enforce it so users cannot override it in config.toml. For Copilot CLI, remove the plaintext file and sign in again with copilot login on a machine with a working keychain. For Claude Code on macOS, follow its recovery steps to move the login back into the Keychain. Replace literal MCP secrets with ${env:NAME} (Cursor) or VS Code inputs with "password": true, whose value VS Code stores securely.
7. Enforce the approved login (reversible). In Claude Code managed settings set forceLoginMethod and forceLoginOrgUUID to your organisation, and allowedProviders to the providers you pay for. Under forceLoginOrgUUID, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and apiKeyHelper credentials are blocked at startup. Note Anthropic's caveat that claude setup-token enforces only forceLoginMethod, so it can mint a token in another organisation. For Codex, set forced_login_method and forced_chatgpt_workspace_id; Codex logs out and exits when credentials do not match.
8. Revoke what was exposed (irreversible for that token). Any credential found in a world-readable file, a committed file or on a lost machine is revoked at the issuer, not just deleted locally. Copilot CLI's /logout does not revoke; use GitHub's authorised OAuth apps page, and for personal access tokens see How to revoke a leaked GitHub token. Claude Code's /logout removes and revokes a credential written by the keyless Console sign-in. Rotate API keys in the issuing console and update the approved store.

Rating what you find

Verify it worked

• Files: a repeat scan finds no plaintext credential files outside approved exceptions, and none with permissive modes.
• Login: /status in Claude Code shows the organisation login and a managed settings source; Codex starts without forced logout.
• Config: no MCP or .env file contains a literal secret; every value is a reference.
• Revocation: revoked tokens fail at the issuer, and the issuer's logs show no use after revocation.

Rollback and common errors

Common failure patterns

• Treating logout as revocation: the token stays valid at the issuer.
• Auditing only the keychain: the environment variable that overrides it is the one actually in use.
• Collecting secrets in the audit: copying token values into a spreadsheet creates a new, larger store.
• Forgetting CI: CLAUDE_CODE_OAUTH_TOKEN and API keys built for laptops often end up in pipelines with longer lives than intended.
• Ignoring per-project files: .mcp.json and .gemini/.env in a repository travel with every clone.

Hardening afterwards

• Prefer short-lived credentials: use apiKeyHelper to fetch short-lived tokens from a vault, or cloud provider authentication, instead of static keys on disk.
• Deploy managed settings by MDM: Anthropic advises keeping login keys in both device-managed and server-managed settings, because server-managed settings reach only accounts already in your organisation.
• Detect new plaintext files: alert on creation of the fallback files listed above through EDR file monitoring.
• Set token expiry: for fine-grained GitHub tokens used with assistants, see How to set expiry policies on personal access tokens.

Small team or large enterprise

A small team can run the checks as a short script on each laptop, agree one assistant and one login method, and fix findings by hand. A large enterprise should push the checks through EDR or osquery, report findings as counts per team, enforce login method and storage through managed settings for every supported assistant, and block unapproved assistants with application control rather than trying to audit every tool.

Metrics

Framework mapping

Practitioner checklist

• Define the approved login method and storage mode for each assistant.
• Check for the Claude Code, Copilot CLI and Codex plaintext files and their modes.
• Search shell profiles and settings env blocks for assistant credential variables, names only.
• Scan every MCP config and .gemini/.env for literal secrets.
• Search repositories for committed assistant config files.
• Move credentials to the keychain and replace literals with references.
• Enforce login method, organisation and storage through managed settings.
• Revoke exposed tokens at the issuer, not just locally.

Standards and references

• Anthropic: Claude Code authentication and credential management
• Anthropic: Claude Code settings files and precedence
• GitHub Docs: Authenticate Copilot CLI
• OpenAI: Codex authentication
• Visual Studio Code: MCP configuration reference
• Cursor: Model Context Protocol
• Gemini CLI: Authentication
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Developer endpoints as NHI stores · AI IDE and Coding Agent Security Guide · Claude Code Security Guide · How to audit MCP servers on developer laptops · AI Coding Assistant Buyer's Guide