wtf is grok-upload-guard?

grok-upload-guard is a small Python tool for people who use Grok Build CLI and want to check whether it has been uploading their whole repository or session traces without them noticing. It does two things: it scans local log files under a hidden .grok folder for evidence that uploads already happened on your machine, and it can patch the Grok config file to turn off whole-repo and session-trace upload settings. The README is careful to say this project did not discover the upload behavior itself. It points to independent wire capture research using tools like mitmproxy, recovered git bundles, and observed multi-gigabyte uploads to a storage endpoint, which has since been discussed widely on Reddit, Hacker News, and elsewhere, and which the Grok account has reportedly acknowledged as intentional. What this tool adds is a way to check your own machine, harden your local config, and reduce further uploads. It makes clear that a clean local scan does not disprove the wider wire capture findings, and a positive local finding is not the same as running a full packet capture yourself. Running detect reads log files, session signal files, the config file, and the auth file to report things like how many upload starts and enqueued files were recorded, what reasons were logged for enabling or disabling uploads, and the current privacy opt-out status. Running fix rewrites specific keys in the config file, such as turning off telemetry, feedback, and trace upload settings, and it creates a timestamped backup of the config first. A combined detect-then-fix mode is also available. The tool makes no network calls itself and needs nothing beyond Python 3.10 or newer. It is explicit about its limits: it only reads local artifacts, so it cannot prove or disprove what happens on the network, and it cannot stop the model from receiving file contents that the agent is intentionally asked to read, such as an environment file. The author recommends starting a new Grok Build session after applying the fix and re-running detect to confirm the change took effect, and treating any secrets used in a workspace where Grok Build ran as potentially exposed.