What Does Bring Your AI Audit and Validate?

Updated

Bring Your AI audits the parts of an agent setup that are easy to break or leak when you move between tools: hooks, MCP review notes, secrets, the scope of AGENTS.md/CLAUDE.md, and validation notes. It also runs a PII scrub audit and produces a validation artifact (BRINGYOUR-VALIDATE.md) that records what was checked and which hook differences were flagged. This applies when you use the CLI to move, sync, or distill a setup across Claude Code, Codex, and Cursor — the audit is part of that flow, not a separate hosted service.

What the audit checks

Area What it looks at
Hooks Flags differences between source and target hook setups
MCP review notes Carries over MCP review notes and flags values that should stay in Keychain or env
Secrets Flags secret values that shouldn't be written into target config
AGENTS.md / CLAUDE.md scope Checks the scope of these context files
Validation notes Confirms validation notes are present and consistent
PII Runs a PII scrub audit

The MCP migration guide preserves command and environment variable references, and flags values that should remain in Keychain or an environment variable rather than being inlined.

How validation runs

Validation happens as part of a migrate command. A preview first confirms what will move, then the migrate step writes a validation file and takes a rollback snapshot.

$ bringyour preview --from claude-code --to codex
Claude Code found.
Codex found.
Move supported: yes
Existing setup can be kept: yes
Original files will not be changed.

$ bringyour migrate --from claude-code --to codex --policy merge
rollback snapshot: ~/.codex/.bringyour-snapshots/...
validation: BRINGYOUR-VALIDATE.md
✓ memories + rules
✓ MCP review notes
✓ skills + validation
✓ rollback snapshots
! hook differences flagged
✓ PII scrub audit
  • Input: a source harness (e.g. Claude Code) and a target harness (e.g. Codex).
  • Action: preview, then migrate with a policy such as merge.
  • Expected result: a BRINGYOUR-VALIDATE.md file, a rollback snapshot path, checkmarks for the categories that passed, and a ! flag for anything that needs review — here, hook differences.

What "review-gated" means in practice

The audit doesn't silently rewrite your setup. Source files are read-only, target files are snapshotted before any write, and a merge policy keeps an existing Codex setup. Anything the audit flags (hook differences, secrets that belong in Keychain or env) is surfaced for you to review rather than auto-applied.

Where the audit fits

The audit and validation run inside the four product paths: moving an existing setup, syncing machines through a local hub, distilling a sanitized snapshot, and building a first setup from history. In the distill path, the audit is what produces the redaction metadata and verification for a sanitized bundle.

Limits to keep in mind

  • The audit reports and flags; it does not guarantee a conflict-free migration. Hook differences are flagged, not resolved.
  • Local-first is the stated design: the CLI runs on your machine, target config stays local, and license verification is a signed local proof after checkout with no phone-home validation.
  • Pricing and access terms aren't covered here — check the site's pricing and buy pages for current details, including the Team Migration Pack listed at $499 for up to 10 people.