Agent privacy check
What does your AI agent reveal when it visits a website? Give it a test link and see exactly what it sends: email addresses, API keys, cookies or internal addresses get flagged, with a fix for each. Free and private; everything is deleted after an hour.
1. Create a test link
2. Ask your agent to visit it
Paste this into Claude Code, Cursor, ChatGPT, Codex or any agent that can open web pages:
Or test any tool or script directly: . The link works for an hour and records up to 10 visits.
3. See what it sent
Waiting for your agent to visit the link…
What this checks
Every request an agent makes carries headers: who it is (User-Agent), what language it prefers, and anything else its tools, plugins or settings add. This check flags the things that should never reach a site you don't control:
- Email addresses in any header, such as a user agent that includes your contact email.
- Credentials: Authorization headers, API keys (OpenAI, GitHub, AWS, Stripe, Slack, Google), tokens and cookies.
- Internal addresses in the Referer header, and full page addresses that reveal what you were working on.
- Language and device details, shown as low-risk: normal, but they make you easier to recognize.
A clean result is not proof of safety
It means nothing obvious was in the request for this one visit. Agents can send different headers to other sites, through other tools, or after an update. Leaks can also happen in what an agent types into a page or sends in a request body, which this check does not see. Run it again after changing settings or updating your agent.
Privacy
The test link only records what the agent sends to it. Credentials and secrets are replaced before anything is saved, email addresses are masked, and IP addresses are never stored. Only you can see the results (your browser holds a private key), and the link and its results are deleted after an hour. Headers added by our own hosting, such as forwarding and IP headers, are left out of the report.
Found something?
Revoke any key that was exposed, then find where the header comes from: agent settings, environment variables, a proxy, a browser profile or a plugin. If the agent itself adds it, report it to its maker with your result.