# Read credentials stored where it runs

> read.credential.host: which products grant it, what stands in the way, what narrows it, and who wants it.

*Source: <https://what-can-it-do.games.sgit.ai/map/capabilities/read.credential.host/index.html> · site v0.8.0 · this file is generated from the same content
as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links
below point at them.*

---

[Play](../../../index.md) / [The map](../../../map/index.md) / [The capabilities](../../../map/capabilities/index.md) / Read credentials stored where it runs

# Read credentials stored where it runs

`read.credential.host` — **read** × **credential** at **host** reach (the machine, container or account it runs as). Family: identity. Effect: **cannot be undone**.

## Granted by 4 of 9

| Profile | Control on the path | Evidence | Via |
|---|---|---|---|
| [Claude Code — web container](../../../map/grants/anthropic/claude-code-remote/ccr-container/index.md) | ● none | observed | shell (Bash) |
| [Claude Code — local · confirm off](../../../map/grants/anthropic/claude-code/local-confirmations-off/index.md) | ● none | documented | shell (Bash) |
| [Claude Code — local · confirm on](../../../map/grants/anthropic/claude-code/local-default/index.md) | ● none | documented | shell (Bash) |
| [Claude Desktop — local tools](../../../map/grants/anthropic/claude-desktop/default/index.md) | ● none | documented | local files and commands (when enabled) |

## What narrows it

**The setting:** keep credentials out of the account the agent runs as: a credential helper, a separate account, or a container without your home mounted

**What it costs:** an afternoon, and re-authenticating where the agent needs a credential of its own

**Tier after:** boundary

## Questions that ask about it

- *Are your cloud, SSH or registry credentials in the home directory of the account it runs as?* — eliciting, reliability 0.3

## In the mandates

- **not wanted** by [A coding assistant on my machine](../../../map/mandates/coding-assistant-on-my-machine/index.md)
- **not wanted** by [The desktop app, with local tools switched on](../../../map/mandates/desktop-app-with-local-tools/index.md)
- **not wanted** by [Chat in the browser, nothing connected](../../../map/mandates/chat-no-connectors/index.md)
- **not wanted** by [A CI job on a hosted runner](../../../map/mandates/ci-job/index.md)

[Edit the primitives](https://github.com/SGit-AI/SGit-AI__Website__Game__What-Can-It-Do/edit/dev/data/primitives.json) · [edit the reductions](https://github.com/SGit-AI/SGit-AI__Website__Game__What-Can-It-Do/edit/dev/data/reductions.json)

---

*[Site index for agents](../../../llms.txt) · [HTML version](https://what-can-it-do.games.sgit.ai/map/capabilities/read.credential.host/index.html)*