RosmarOps

RosmarOps for security teams

RosmarOps is a read-only program that checks what AI agents can do on a computer. To do that it opens credential files and starts PowerShell, which is exactly what a credential stealer does. So this page sets out exactly what it does, so you can check it before you allow it.

1. Which files it opens and why

  • The configuration of AI agents: Claude Code, Cursor, Cline, GitHub Copilot, Codex, Grok Build, Antigravity CLI, Gemini CLI and Hermes Agent. Their permissions, MCP servers, hooks, skills and instructions (AGENTS.md, CLAUDE.md, GEMINI.md and similar). The full list, file by file, is in the README: https://github.com/qtorb/rosmarops#what-it-reads
  • Credential files, to know which keys each agent can read:
    • the .env files in repositories;
    • those of npm, AWS, GitHub CLI, git, Railway and Supabase;
    • the agents' own session files.
  • Repositories: the files tracked by git and their history, to find saved keys, plus their hooks and workflows.
  • On Windows: scheduled tasks, Microsoft Defender exclusions and some registry policy keys that configure agents. It only reads them.

It never shows a whole key: the report shows the first 4 and the last 4 characters. It doesn't open files larger than 2 MB. It skips node_modules, .git and the other dependency and build folders.

2. Which processes it starts

On Windows:

  • powershell.exe -NonInteractive -NoProfile, with no window, for read-only queries (Get-ScheduledTask, Get-MpPreference, Get-ItemProperty). It also uses it to show its own windows and alerts: connecting the space, sending a problem, choosing the projects folder and the notification when it finishes.
  • code --list-extensions, to know which AI extensions VS Code has.
  • git, only with local read commands (rev-parse, ls-files, rev-list, config) and with hooks turned off.
  • explorer.exe, to open the report in the browser.

On macOS and Linux it starts git the same way, and the system command to open the report and show the notification (open, xdg-open, notify-send).

It installs no services, drivers or scheduled tasks. It doesn't change the registry or any program's configuration.

3. What it writes and where

Only inside %USERPROFILE%\.rosmarops (on macOS and Linux, ~/.rosmarops):

  • its state, state.json;
  • the reports, in HTML and JSON;
  • in the data folder, the send log (rosmarops-sends.log) and the local list of problems it runs into.

Nothing else.

4. When it connects and where to

By default, never. It connects only in two cases, always over HTTPS and only to app.rosmarops.com, port 443:

  • if the person connects the computer to their space: it sends their results, encrypted, after each check;
  • if the person presses «Send» when the program runs into a problem: it sends the list of error codes, with no paths, names or keys. This is from version 0.11.0.

Every send is listed in rosmarops-sends.log.

It honours HTTPS_PROXY. If you block app.rosmarops.com, everything else works the same: the check and the report need no network.

5. How this is guaranteed

Every promise on this page has an automated test in the code, which runs on every change:

  • no network outside that single host;
  • no writes outside its folder;
  • no key ever leaves in full.

They are listed one by one in the trust model: https://github.com/qtorb/rosmarops/blob/master/docs/trust-model.md

The code is open source (AGPL-3.0): https://github.com/qtorb/rosmarops

6. How to check the binary

It isn't signed with a code-signing certificate yet. To know it is the one built in the repository:

  1. Checksum. Every release publishes SHA256SUMS.txt. On Windows:

    Get-FileHash rosmarops.exe -Algorithm SHA256

    and compare the result with the rosmarops.exe line.
  2. GitHub attestation. It ties the binary to the exact commit and the workflow that built it:

    gh attestation verify rosmarops.exe --repo qtorb/rosmarops

  3. Reproducible build. You can build it yourself from the release tag and get the same checksum. The steps are in the README: https://github.com/qtorb/rosmarops#build-it-yourself

7. Which alerts may fire and why

  • «Credential access», because it opens files such as .aws/credentials, .git-credentials or the agents' session files. That's what it measures: which keys each agent can read.
  • «PowerShell started by an unsigned program», because that's how it runs its read-only queries and shows its windows.
  • «Defender exclusions queried» (Get-MpPreference), because it tells you when a new exclusion appears, which is something malware also does.
  • «Uncommon program» or SmartScreen, because it is new, has no reputation yet and isn't signed.
  • Many file reads in a short time, because it walks through projects looking for keys.

None of these alerts comes with writes outside .rosmarops or connections to any other destination. If you see either, it isn't RosmarOps as we publish it.

8. How to allow it

  1. Check the binary as in section 6.
  2. Allow it by its SHA-256 hash, not by its path. That way, a modified copy doesn't inherit the permission. Every new version has a new hash.
  3. If you want, try it first on a test computer and look in your EDR at what it opens, starts and writes. It should match this page.
  4. If you never want it to connect, block app.rosmarops.com. It works the same.

9. Contact

To report a security issue: https://github.com/qtorb/rosmarops/blob/master/SECURITY.md

For anything else: legal@rosmarops.com