The latest release of idogol24/weir is v0.8.0. The provided information does not include the changelog for this version. The repository is a Python tool that checks whether API keys leak during agent execution — into traces or logs, or into the context passed to models. You can plant fake keys in agents you build yourself to test for leakage, and in Claude Code you can check whether real keys enter the session context or go out through tool calls.
weir runs the agent flow as a separate execution tool and judges the result as leak, safe, or incomplete. In Claude Code it also offers optional masking of keys in tool results or removal of them via hooks. It is distributed under the Apache-2.0 license, and the project description gives detection of key exposure in agents and coding agents as its purpose. The author states that they found an MLflow vulnerability (CVE-2026-116691). This is a case presented by the project itself, and based on the provided information alone it cannot be regarded as an independently verified result.
The documentation points out detection limits, such as cases where only part of a key value is exposed or where it is passed in several fragments. It is therefore more accurate to view this as a means of checking exposure along the explicitly stated execution paths than as a tool that catches every form of key leakage. What changed in v0.8.0, and verification results for the detection scope, are not in the provided information.