wtf is grokpatrol?

grokpatrol is an offline command line tool written in Go that checks a computer for signs that the Grok Build CLI silently uploaded git repositories to xAI's cloud storage. The README describes a real incident where Grok Build CLI ran a background process that copied entire git repositories, including files that had been deleted from the current checkout but were still recoverable from git history, which is often exactly where secrets and credentials end up hiding. The tool works entirely on your own machine and does not send any data anywhere. It scans the filesystem for signs of Grok's upload folders, staged archive files, and executables that reference the destination storage bucket. It also reads Grok's log files, including older rotated and compressed ones, looking for specific upload events, checks the configuration file for two settings that are supposed to block uploads, and tries to figure out which version of Grok is installed. Finally, it searches git history in any affected repository for files that look like credentials or secrets, including ones already removed from the working directory. After scanning, grokpatrol prints a verdict such as clean, exposed, or compromised, along with a summary of what it found: how many repositories and archives were queued, whether upload actually completed, and a list of file paths that likely contain secrets needing rotation. Running it with a verbose flag shows full details like exact upload destinations and secret file names, while a JSON output mode supports feeding results into automated fleet scanning across many machines. Installation offers three options: a one line script that downloads a verified release binary, building from source using the Go toolchain, or manually downloading and checking a release binary against provided checksums. The tool currently supports macOS and Linux only, not Windows. It is aimed at security teams, developers, and anyone concerned their code or credentials may have been exposed by this specific incident, and its exit code only confirms that the scan ran, not what it found, so reading the verdict output is required.