Muretto shows every database, bucket and deployment your coding agents created, and which ones anyone can open.
Add customer import with file uploads
Done! Customer import is ready.
✓ Task complete
The problem
Ask for a feature and your agent writes the code, then creates the table, the storage bucket and the preview deploy to go with it.
Every line the agent wrote shows up in a pull request. The tables, buckets and deployments it created in your cloud accounts show up nowhere.
A session log records what the agent tried and what the API answered at that moment. Only your providers know what exists now, and who can reach it.
5 resources in 29 minutes, across two providers. Illustration.The code got a review. The cloud got nothing.The log says success. Your providers say 3 are open to anyone.
Meet Muretto
Every database, bucket and deployment is matched to the agent session that created it, with the evidence. If it can't prove it, it says creator unknown.
What anyone on the internet can read, download or open is flagged in red, worst first.
Read-only by design. It looks at your accounts and never touches them.
Real output format from the CLI's formatter. Fictional projects and names.
What it catches
Muretto checks your real accounts, not the agent's summary, and tells you in plain words.
Row level security is off, so your app's public key reads every row.
via the Supabase security advisor
The storage bucket is public. Every upload is one URL away, no key needed.
via the bucket's public setting
Deployment protection is off, so the preview URL works without logging in.
via Vercel deployment protection
A secret-looking variable with a NEXT_PUBLIC_ prefix ends up in client code.
checked by name; values are never stored
A week-old database branch the agent made for testing, billed by the hour.
7 days old · you decide: keep or not needed
No agent session created it. Muretto says so plainly instead of guessing.
no agent evidence · never guessed from timing
How it works
Adds a tiny Claude Code hook that notes what each agent session does. Your settings are backed up, and it's removable.
Give it read access to the accounts your agents touch. Tokens live in your OS keychain.
See everything your agents created and what's open to the internet right now.
Under the hood:hooks capture tool calls→read-only APIs list what exists→each resource is exact or creator unknown
Trust and security
Every provider request goes through one allowlisted module. A test fails if any other code can reach the network.
In our test suite, mutation-tested. Every resource is exact, with evidence, or creator unknown.
Redacted when recorded and again at output. Tokens live in your OS keychain. Env var values are never stored.
Works without an account. Team sync is opt-in, and every field it sends is documented.
SYNC_PAYLOAD.md ↗Read every line, run it yourself, fork it.
github.com/tolgayayci/muretto ↗Who it's for
You build with Claude Code. Muretto tells you when your agent left a table readable, a bucket public or a preview open.
muretto exposedSync sessions across your team, see which teammate's agent created what, review unknown creators, keep the evidence.
Thanks. We'll email you when team sync opens up.
What sync sendsexcerpt · SYNC_PAYLOAD.md
session.task_title80 characters at most, redactedsession.repo.path_hasha hash; the path never leavesresource.nameredactedtokens · keys · full promptsnever sentIntegrations
Don't see yours?
Add a provider in an afternoon. Adapters declare scan endpoints, how to extract resource ids from tool calls and exposure rules, and every network call still passes the read-only allowlist.
Why now
And the obvious fix for error 42501 re-exposes them.
Illustration of a typical agent fix.
Where it's going
Claude Code on Supabase and Vercel.
Every agent and provider.
Review and policy for everything agents change outside the repo.
How it compares
| Tool | Agent sessions | What exists now | Exposure | Which session made it |
|---|---|---|---|---|
| Claude Code OpenTelemetry / Compliance APISees sessions, not what exists in your providers. | ✓ | — | — | — |
| Supabase Security AdvisorSees exposure, not which agent session created it. Supabase only. | — | Supabase | ✓ | — |
| Stripe ProjectsService-level ledger of what was provisioned through it. Doesn't see tables, buckets or deployments created inside. | — | services | — | — |
| Agent session loggersRecord what the agent said and ran, not provider state. | ✓ | — | — | — |
| MurettoJoins session → resource → exposure, with evidence. | ✓ | ✓ | ✓ | ✓ |
No tool we found joins all four. We're generous on purpose: if we got yours wrong, open an issue.
Full comparison →Who's building it
Open source. Runs on your machine. Only ever reads.
$