moatleak by Horizen Labs Get moatleak

Free · Open source · Runs offline

Your moat is leaking.

See where your AI prompts really go.

moatleak reads the logs your AI tools already keep and shows which companies processed your prompts, who owns them and which countries they sit in. It runs on your machine and makes no network calls.

Get moatleak See a sample report

Python 3.11+ · Standard library only · No network code · Apache-2.0

Cards from a real moatleak report: one developer's logs, 22 Sep – 7 Oct 2026.

One machine. Real logs.

We ran it on our own machine first.

These are the headlines of the sample report, word for word: the maintainer's own Hermes and Claude Code logs, 22 Sep – 7 Oct 2026.

Extent

10 companies. 8 parent groups. 2 countries.

Including Anthropic, Kuaishou and Baidu.

Fragmentation

One conversation was split across 3 companies in 2 countries.

7 new companies joined your network in 9 days.

Footprint

63% of your prompts were processed by companies headquartered in the United States, 36% in China.

Anthropic withheld the location of 217 of your prompts.

Country means the headquarters country of the company and its ultimate parent, as recorded in moatleak's sourced registry. It is not the location of a server, unless the tool logged one. The withheld count covers all Claude Code history on that machine. These numbers describe one machine. Yours will differ.

What your report looks like

Real cards from the sample report. Every card in your report can be downloaded as a PNG to share.

  • Card: Your prompts were processed by 10 companies, owned by 8 groups, in 2 countries. United States 63%, China 36%, unknown or withheld 1%.
    Your network at a glance: every company, grouped by the country it is headquartered in.
  • Card: radial network from You through Hermes and Claude Code, OpenRouter and the Anthropic API, to 10 companies and their parent groups; arcs show United States 63%, China 36%.
    The whole network: you, your tools, how they reached each company, and the parent groups behind them.
  • Card: How your prompts flowed. Sankey diagram from tool to access method, company, parent group and country.
    How prompts flowed: tool → access method → company → parent group → country.
  • Card: Where your prompts went. 2 countries, 1% undisclosed; tile grid and the laws that can compel access, by share of prompts.
    Where your prompts went, and which laws can compel access to them, with sources.
  • Card: In this period, 3 of your conversations contained personal data. They were handled by 7 companies in 2 countries.
    Optional content scan: how many conversations matched a local detector. The text itself is never stored or sent.

Open the full sample report →

How it works

  1. Install

    Install it from PyPI with pipx install moatleak, or pip install moatleak. Python 3.11 or newer, on Linux or macOS.

  2. Scan

    moatleak scan reads the records your AI tools already keep, read-only: Hermes agent logs and state.db, and Claude Code transcripts.

  3. Read your report

    It writes one self-contained HTML report, plus a CSV and SQLite ledger and the JSON it was built from, into ./moatleak-report/. Nothing else is written.

pipx install moatleak
moatleak sources
moatleak scan

moatleak sources shows which data sources were found. Supported today: Hermes and Claude Code.

Built to be checked, not trusted.

A tool that maps where your data went shouldn't send any of it anywhere. moatleak doesn't, and you can prove it.

What it reads

SourceDefault location
Hermes agent logs~/.hermes/logs/agent.log*
Hermes state.db~/.hermes/state.db (opened read-only)
Claude Code transcripts~/.claude/projects/**/*.jsonl

It uses endpoints, provider names, model names, token counts, timestamps, and location fields where the tool logged them.

What it never does

  • No network calls. scan ends by printing "No network calls were made."
  • No telemetry.
  • Never writes into the folders it scans.
  • Never stores your prompt text.
  • The report loads nothing remote: no fonts, scripts or images.
  • The package contains no network code at all.

Verify it yourself

  1. Linux: run it with no network at all. If anything tried to connect, it would fail.

    unshare -rn moatleak scan --out /tmp/moatleak-offline

  2. macOS: turn on airplane mode and run moatleak scan. A sanity check, not proof.

  3. In a checkout of the source, search for network modules. There are none.

    grep -rnE "urllib|http\.client|socket" src/moatleak --include='*.py'

This website follows the same rules: no analytics, no cookies, no trackers, nothing loaded from anyone else's servers.

What's in your report

  • Your inference networkevery company, parent group and country, in one picture
  • Where your prompts wentshare by country, and the laws that can compel access
  • Your network keeps growingwhich company served you on which day, and when new ones appeared
  • Your AI footprint, slide by slidethe headlines as shareable slides
  • Your receiptan itemised list of every company
  • How your prompts flowedtool → access method → company → parent group → country
  • What your prompts containedoptional: counts from the local content scan
  • Every company that processed your promptsthe full table, with sources
  • How this was measuredmethod, coverage and confidence

What's next

  • Planned

    More readers

    Codex, Cursor, LiteLLM, Continue, Aider and OpenWebUI.

  • Planned

    Optional account connectors

    OpenRouter, Anthropic and OpenAI usage data, and cloud endpoint regions. Separate opt-in packages: they need the network and an account key, so they will never be part of the core tool.

  • Planned

    Optional content classification

    Classify what kind of content left your machine, as a separate opt-in package (moatleak-jev). The core stays offline.

Want another tool supported? Readers are welcome as contributions. Contributing guide

Frequently asked questions

Does moatleak send my data anywhere?

No. scan and sources make no network calls, there is no telemetry, and the package contains no network code at all. See "Verify it yourself" above to check.

Does it read my prompts?

Only if you ask. By default it uses call metadata: which company served a call, when, token counts and similar. With --scan-content it runs local pattern detectors over your prompt text and records only how many conversations matched each category. The matched text is never written anywhere.

Is "country" where my prompt was processed?

Not necessarily. It is the headquarters country of the company and its ultimate parent, as recorded in the registry. It is a server location only when your tool logged one.

Where does the company information come from?

From moatleak's registry of 31 providers, shipped with the tool. Each company, parent and country claim cites a source, a check date and a quoted passage. Where no parent is sourced, it says "unknown". The registry data is CC BY 4.0, and corrections are welcome.

Which AI tools does it support?

Hermes and Claude Code today. Codex, Cursor, LiteLLM, Continue, Aider and OpenWebUI are planned.

What does it cost?

Nothing. moatleak is free and open source under Apache-2.0.

Will my numbers look like the sample?

Probably not. The sample describes one machine over 22 Sep – 7 Oct 2026. Yours depends on which tools and providers you use.

Who makes moatleak?

moatleak is built by Horizen Labs.

moatleak by Horizen Labs

Deploy Sovereign AI at your company.

moatleak shows where your prompts go today. Horizen Labs helps companies decide where they go next.

Talk to Horizen Labs

A plain link. No tracking, no data from your report.