sandspy 0.1.1

Real-time security monitor for AI coding agents
Documentation
[agent]
name = "Claude Code"
process_names = ["claude-code", "claude"]
description = "Anthropic's AI coding agent"

[expected.network]
allowed_domains = [
  "api.anthropic.com",
  "claude.anthropic.com",
  "statsig.anthropic.com",
  "sentry.io",
]

[expected.filesystem]
normal_patterns = [
  "**/*.rs", "**/*.py", "**/*.ts", "**/*.js",
  "**/Cargo.toml", "**/package.json",
  "**/.git/**",
  "**/README*", "**/LICENSE*",
]

[alerts]
sensitive_file_access = true
unknown_network = true
shell_dangerous_commands = true
clipboard_read = true
env_secret_access = true
excessive_file_reads = 500
excessive_data_out = "10MB"

[risk_weights]
sensitive_file_read = 15
unknown_network_connection = 25
secret_env_access = 20
dangerous_command = 30
clipboard_read = 10
excessive_scope = 15