ReferencePassport CLI Community Edition

View and analyze results

View as Markdown

Use the browser and terminal dashboards to review captured traffic, understand how credentials are being used, and export your findings.

Start the traffic inspector

Run the following command to start the traffic inspector in the background:

$passport lens start

For all options, see passport lens start.

Route traffic through the proxy

Your tools don’t automatically send traffic through the inspector. Setting proxy environment variables tells curl and other HTTP clients to route requests through it so the inspector can capture them.

Current terminal

To configure your current terminal, run:

$eval "$(passport lens env)"

Future terminals

To configure future terminals automatically, add the following to your shell profile:

Zsh:

$echo 'eval "$(passport lens env 2>/dev/null)"' >> ~/.zshrc

Bash:

$echo 'eval "$(passport lens env 2>/dev/null)"' >> ~/.bashrc

For Bash login shells, use ~/.bash_profile instead of ~/.bashrc.

New terminals pick this up automatically. To apply the change in your current terminal, run:

$source ~/.zshrc   # or: source ~/.bashrc

Run your tools

With the traffic inspector running, use your AI agents, command-line clients, or scripts as you normally would. The traffic inspector captures every API call they make, recording the destination, client, and any credentials present in each request.

Open the dashboard

You can view captured traffic in your browser or directly in the terminal.

In your browser

The browser dashboard is a live view of captured traffic that opens in your default browser. Run the following command to open it:

$passport lens report

For all options, see passport lens report.

In the terminal

The terminal dashboard is a live, interactive view of captured traffic that runs directly in your terminal. It shows the same findings as the browser dashboard without requiring a browser window.

Run passport to open it:

$passport

You can customize the display using options such as --theme, --no-animation, and --ascii. For all display options, see Options. Once open, you can also adjust settings and navigate using keyboard shortcuts.

Review captured traffic

Both dashboards show similar findings. The browser dashboard displays a summary and a searchable findings table. The terminal dashboard shows a live traffic feed alongside system and findings breakdowns.

In your browser

The dashboard shows a summary of captured traffic:

  • The number of credentials observed.
  • The number of unique destinations.
  • The number of secret types detected.
  • The number of clients observed.
  • The date and time of the most recent capture.

The findings table shows each request where a credential was observed, with the following details:

ColumnDescription
Detected atTimestamp when the secret was detected.
DestinationThe host or endpoint the request was sent to, for example api.anthropic.com or example.com.
ClientThe application or user agent that sent the request, for example claude-code/2.1.212 or curl/8.7.1.
TypeThe type of secret detected, for example x-api-key header or Bearer token.
Masked secretA redacted version of the detected secret. Only a small portion is shown to help identify it while keeping the value protected.

To filter the table, search by destination, client, type, or masked secret.

To load the latest traffic, click Refresh.

To save a copy of your findings, click Export report in the upper right of the dashboard.

In the terminal

The terminal dashboard displays the following sections:

Activity graph — A graph of findings over time.

Summary — The proxied request count, total findings, the most common secret type, and inspector uptime.

Findings breakdown — Panels showing finding counts grouped by destination (host), app (client), and detection (secret type).

System information — Shows the proxy port, body scanning mode, CA certificate path, daemon PID, and browser report URL.

Traffic feed — A live table of captured requests:

ColumnDescription
TimeTimestamp of the request.
MethodHTTP method, for example GET.
HostDestination host.
URLRequest path.
StatusDetection result. Shows Leaked when a secret is found.
AppClient that made the request, for example curl/8.7.1.
DetectorSecret type detected, for example Bearer token.

Use the following keyboard shortcuts to interact with the terminal dashboard:

KeyAction
sStart or stop the traffic inspector.
fToggle findings-only filter.
oOpen the browser dashboard.
↑ / ↓Scroll the traffic feed.
wCycle the time window: 5m, 15m, 30m, or 1h.
TCycle the color theme.
?Toggle the help screen.
qQuit the terminal dashboard.

Understand your findings

Reviewing captured traffic gives you visibility into how AI agents and developer tools are using credentials on your local machine:

  • See which APIs your clients are calling — Get a complete picture of API activity from every agent and client running on your machine. Confirm the destinations and request patterns match what you’d expect.
  • Understand how credentials are being used — See which credential types appear in requests and which clients are using them. Secrets aren’t automatically captured in request bodies. You can use the --show-body option to enable request body scanning for more complete coverage.
  • Track credential usage across clients — Before rotating a secret, use the client and masked secret columns to identify every client and destination currently using it.
  • Review client activity patterns — The client column shows which clients are active and what they’re accessing, giving you a full picture of API activity on your machine.

Stop the traffic inspector

When you’re done, stop the traffic inspector:

$passport lens stop

Stopping the inspector doesn’t automatically clear the proxy environment variables set by passport lens env. Those variables remain active in your shell, and tools like curl will fail trying to route requests through a proxy that’s no longer running. Unset them manually after stopping:

$unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy \
>      NODE_EXTRA_CA_CERTS SSL_CERT_FILE \
>      REQUESTS_CA_BUNDLE CURL_CA_BUNDLE \
>      NO_PROXY no_proxy