What is grok-upload-audit?

grok-upload-audit is a tool for people worried that the xAI Grok Build coding tool secretly uploaded their code, and possibly their secret API keys, to xAI servers. It works as a skill inside Claude Code or OpenAI Codex, two AI coding assistants that can load small add on tools, but it can also be run on its own with no assistant at all, since it is really just a self contained Python script. The background is that some versions of Grok Build package a user project folder into an archive and send it to a cloud storage bucket, sometimes without the user turning that setting on themselves. Grok keeps detailed local logs of everything it does, and this tool reads those logs to reconstruct what actually happened: which folders were packaged, how many times, how large the uploads were, and where they were sent. It also checks whether the upload setting was turned on by the user or was switched on remotely, and it scans local logs for signs that values from a person's own secret files, like environment variable files, ended up inside what was uploaded. Importantly, it never prints, saves, or sends the actual secret values it finds. It only reports which secret names appear to have leaked and how many times, so you learn what happened without creating a new copy of the secret itself. Once the audit is done, the tool can write out a checksummed evidence file you could attach to a complaint, and it can generate a draft data deletion request letter that cites relevant privacy laws and is filled in with your own account details and findings. It can also add a setting to your local Grok configuration file that blocks future uploads, but only if you choose to apply it. The tool is specific to Grok Build's known behavior and openly explains that it does not apply to Claude Code or Codex, since those tools work differently and do not upload entire codebases. This makes it most useful for developers who use Grok Build and want a clear, evidence based answer instead of guessing.