How it works
Find it, fix it, prove it
Zinloop is a small scanner you push to laptops and a console where you see every client at once. The scanner only reads files. Nothing changes on a laptop until a technician runs a fix.
zinloop fix-secrets --apply ✓ 2 keys moved to Windows Credential Manager
1 · Find
Every AI connector on every laptop
AI assistants connect to company systems through small programs called MCP servers. Their settings live in files on the laptop. The scanner reads those files for every user profile on the computer:
Claude Desktop and Claude Code
The desktop app's settings, Claude Code's global and per-project servers.
Cursor and Windsurf
User-wide and project connectors.
VS Code
User settings and project .vscode/mcp.json files.
What it flags
Plain rules, plain language
| Finding | Risk | What it means |
|---|---|---|
| Password or token in plain text | High | Keys typed into a connector's settings, headers, arguments or address |
| Gives the AI a terminal | High | Connectors that can run any command on the laptop |
| Whole-disk file access | High | File connectors allowed into the home folder or a whole drive |
| Unencrypted connection | High | Remote connectors over plain http |
| Risky container settings | High | Docker with privileged mode, host networking or the Docker socket |
| Unpinned package | Medium | Connectors that download whatever version is newest at every start |
| Exposed key not replaced | Medium | A key Zinloop protected that was in plain text before and hasn't been rotated |
| Sends data to an outside service | Low | Remote connectors, listed so you know where data goes |
2 · Fix
Keys move into the keychain. The AI tool keeps working.
zinloop fix-secrets --apply saves each key in Windows Credential Manager, macOS Keychain or the Linux secret store, backs up the original file, and rewrites the connector to start through Zinloop, which hands the key over at start-up. If any step fails, the file is left exactly as it was.
Keys that sat in plain text should still be replaced. zinloop rotate lists them and takes the new key from the provider.
3 · Prove
A report your client can read
Each client gets a risk score, the laptops that haven't reported, and a printable report in plain English: what was found, what was fixed, what still needs a decision.
See what AI your clients have connected
Create a free account, add one client and run the scanner on up to 25 laptops. You keep the findings.