fnox audit

• Usage: fnox audit [FLAGS]

Show the local access audit log

Prints the most recent entries of the log written when [audit] enabled = true (or FNOX_AUDIT=on) is set: when each secret was read, by which command, under which profile, and through which provider. Values are never recorded. The log is a file the current user can write, so it is a record of fnox's activity, not tamper-proof evidence.

Flags

• -c --command <COMMAND> — Only entries from this command, such as exec, get, hook-env, mcp, or proxy
• -n --limit <LIMIT> — Number of entries to show, most recent last (default: 20)
• -p --provider <PROVIDER> — Only entries for this provider
• -s --secret <SECRET> — Only entries for this secret name
• --json — Print entries as JSON lines
• --path — Print the log file path and exit
• -h --help — Print help

Examples

Show the last 20 reads

fnox audit

Show recent reads of one secret

fnox audit --secret DATABASE_URL -n 5

Show reads made through the MCP server as JSON lines

fnox audit --command mcp --json

See also

• Audit log