truf-server/app/KEYCHECKERS.md

Keychecker Layout

Normal input and authority:

PostgreSQL keycheck_candidates      fenced provider work queue
PostgreSQL keycheck_results         authoritative history
PostgreSQL keycheck_current_state   authoritative current classification
D:\truf\runtime\proxy.txt           optional provider proxy input

found_secrets.jsonl, *Results.jsonl, and *Checked.txt/status files are projector-owned compatibility outputs. They may lag and normal providers do not read or write them.

Shared helper:

D:\truf\app\keycheckers\keycheck_common.py

keycheck_runner.py --input-mode postgres is the default managed mode. --input is accepted only with explicit --input-mode jsonl for reviewed offline/import compatibility. Provider completion inserts the result, updates current state, completes the exact candidate lease, releases candidate capacity, and creates its projection job in one PostgreSQL transaction.

DeepSeek

python supervisor.py --config config.yaml --cmd "recheck deepseek all --max-keys 100"

Output folder:

deepseek\deepseekAlive.txt
deepseek\deepseekNoBalance.txt
deepseek\deepseekDead.txt
deepseek\deepseekLimited.txt
deepseek\deepseekNetwork.txt
deepseek\deepseekUnknown.txt
deepseek\deepseekChecked.txt
deepseek\deepseekResults.jsonl

Qwen / DashScope

python supervisor.py --config config.yaml --cmd "recheck qwen all --max-keys 100"

The checker validates QwenDashScope findings with GET /models against the public DashScope OpenAI-compatible region endpoints. Coding Plan keys (sk-sp-...) use https://coding-intl.dashscope.aliyuncs.com/v1 by default. Workspace-specific endpoints can be added with --base-url via keychecks.service_args.qwen or QWEN_BASE_URLS.

Output folder:

qwen\qwenAlive.txt
qwen\qwenNoBalance.txt
qwen\qwenNoContext.txt
qwen\qwenDead.txt
qwen\qwenLimited.txt
qwen\qwenRestricted.txt
qwen\qwenNetwork.txt
qwen\qwenUnknown.txt
qwen\qwenChecked.txt
qwen\qwenResults.jsonl

Kimi / Moonshot AI

python supervisor.py --config config.yaml --cmd "recheck kimi all --max-keys 100"

The explicit MOONSHOT_API_KEY / KIMI_API_KEY detector is validated without generation by calling GET /v1/users/me/balance on the independent global and China Moonshot endpoints.

Output folder:

kimi\kimiAlive.txt
kimi\kimiNoBalance.txt
kimi\kimiDead.txt
kimi\kimiLimited.txt
kimi\kimiRestricted.txt
kimi\kimiNetwork.txt
kimi\kimiUnknown.txt
kimi\kimiChecked.txt
kimi\kimiResults.jsonl

Groq

python supervisor.py --config config.yaml --cmd "recheck groq all --max-keys 100"

The checker validates TruffleHog Groq findings with GET https://api.groq.com/openai/v1/models and does not run generation probes.

Output folder:

groq\groqAlive.txt
groq\groqDead.txt
groq\groqLimited.txt
groq\groqRestricted.txt
groq\groqNetwork.txt
groq\groqUnknown.txt
groq\groqChecked.txt
groq\groqResults.jsonl

Replicate / xAI / HuggingFace

python supervisor.py --config config.yaml --cmd "recheck replicate all --max-keys 100"
python supervisor.py --config config.yaml --cmd "recheck xai all --max-keys 100"
python supervisor.py --config config.yaml --cmd "recheck huggingface all --max-keys 100"

These checkers validate built-in TruffleHog findings through non-generating endpoints: Replicate account lookup, xAI model list, and HuggingFace whoami.

Anthropic

python supervisor.py --config config.yaml --cmd "recheck anthropic all --max-keys 100"

Output folder:

anthropic\anthropicAlive.txt
anthropic\anthropicNoQuota.txt
anthropic\anthropicDead.txt
anthropic\anthropicLimited.txt
anthropic\anthropicRestricted.txt
anthropic\anthropicNetwork.txt
anthropic\anthropicUnknown.txt
anthropic\anthropicChecked.txt
anthropic\anthropicResults.jsonl

AWS

Default mode only checks STS identity:

python supervisor.py --config config.yaml --cmd "recheck aws all --max-keys 100"

Optional Bedrock probing is configured under keychecks.service_args.aws, then run:

python supervisor.py --config config.yaml --cmd "recheck aws all --max-keys 100"

Output folder:

aws\awsAlive.txt
aws\awsBedrock.txt
aws\awsAdmin.txt
aws\awsCanary.txt
aws\awsQuarantined.txt
aws\awsAccessDenied.txt
aws\awsDead.txt
aws\awsNetwork.txt
aws\awsUnknown.txt
aws\awsChecked.txt
aws\awsResults.jsonl

Canary AWS credentials are detected before active AWS probes when TruffleHog provides ExtraData.is_canary / canary message. If metadata is absent, STS ARN containing canarytokens is also classified as awsCanary.txt and IAM/Bedrock probes are skipped.

Azure

python supervisor.py --config config.yaml --cmd "recheck azure all --max-keys 100"

This checks Azure service-principal findings from DetectorName=Azure using tenantId, clientId, clientSecret from RawV2.

DetectorName=AzureOpenAI is placed into azureOpenAIUnresolved.txt unless an endpoint/resource name is available.

Output folder:

azure\azureAlive.txt
azure\azureDead.txt
azure\azureRestricted.txt
azure\azureNetwork.txt
azure\azureUnknown.txt
azure\azureOpenAIUnresolved.txt
azure\azureChecked.txt
azure\azureResults.jsonl

Retry Flags

Common flags:

--retry-network
--retry-limited
--retry-unknown
--recheck-all
--max-keys N

Network/proxy failures are committed with the network status group and can be selected for a bounded PostgreSQL recheck. *Network.txt is only its asynchronous compatibility projection.