@postman/postman-passport

 Passport CLI - Community Edition

Review the secrets your agents are sending.

Overview

The Postman Passport CLI Community Edition is the free, self-contained edition of the Passport CLI. It helps you identify secrets used by AI agents, scripts, and CLI tools. It analyzes traffic locally, never stores or sends your secrets anywhere, and always redacts any detected secrets in its reports.

Use it to audit agents for accidentally transmitted API keys, tokens, and other credentials.

Why it matters: AI agents can generate outbound HTTP(S) requests on your behalf. A secret intended for one service can accidentally end up in a request to another. The Passport CLI Community Edition sits in the request path, detects these secrets, and shows you what was sent.

Installation

npm install -g @postman/postman-passport

Verify the install:

passport --version

Quickstart

Scan a single command

Run any command through a temporary local proxy. The proxy is created for the duration of the command and torn down afterwards.

passport lens run -- curl https://postman-echo.com/get

Inspect request bodies as well as headers and URLs, and emit machine-readable findings:

passport lens run --show-body --json -- ./my-agent

Run in the background

Start the detector once and inspect traffic from multiple commands, tools, and shells.

passport lens start

# Customize the port, inspect request bodies, or skip opening the report
passport lens start -p 9000 --show-body --no-open

To route traffic automatically, add the following to your shell profile:

# Zsh
echo 'eval "$(passport lens env 2>/dev/null)"' >> ~/.zshrc

# Bash
echo 'eval "$(passport lens env 2>/dev/null)"' >> ~/.bashrc

To reload your current shell, new terminals pick this up automatically:

source ~/.zshrc   # or source ~/.bashrc

Review findings

You can review captured traffic and identified secrets in your browser or directly in the terminal. The browser dashboard lets you filter, sort, and export findings. The terminal dashboard shows a live traffic feed, finding counts, and system information.

Open the browser dashboard to explore captured traffic:

passport lens report

Serve the dashboard on a specific port without opening a browser:

passport lens report --port 7000 --no-open

To view a live traffic feed, finding counts, and system information directly in the terminal, run passport with no subcommand:

passport

Manage the detector

# Detector status and captured finding count
passport lens status
passport lens status --json

# Stop the background detector
passport lens stop

# Remove certificate-authority files left by an unclean shutdown
passport lens clean

Command reference

Command	Description
passport lens run -- <your-command>	Run a command through a temporary local proxy and report redacted secret findings.
passport lens start	Start a long-lived background detector.
passport lens status	Show the detector status and captured finding count.
passport lens report	Open the findings dashboard in your browser.
passport lens env	Print the environment variables needed to route traffic through detector.
passport lens stop	Stop the background detector.
passport lens clean	Remove certificate-authority files left after an unclean shutdown.

Options

• passport lens run
  • --show-body — Detect secrets in request bodies, in addition to headers and URLs
  • --json — Emit redacted findings as JSON lines to stderr
• passport lens start
  • -p, --port <port> — Port to listen on (default: 30914)
  • --show-body — Detect secrets in request bodies, in addition to headers and URLs
  • --no-open — Do not open the report in the browser after starting
• passport lens status
  • --json — Emit raw JSON
• passport lens report
  • -p, --port <port> — Port to serve on (default: an available port)
  • --no-open — Do not auto-open the browser; just print the link

Resources

• Documentation
• Command reference

Support

Report an issue: postmanlabs/passport-cli-support

Please include your OS, Passport CLI version, passport lens status --json output, and the command you ran. Never paste unredacted secrets into an issue.

Built by Postman