[FEATURE] Optional local RDP exposure check + brute-force attempt summary (Windows, opt-in)
Preflight Checklist
- [x] I have searched existing requests and this feature hasn't been requested yet
- [x] This is a single feature request (not multiple features)
Problem Statement
Claude Code often runs on machines that also have Remote Desktop Protocol (RDP) enabled for remote access. If RDP is exposed to the internet with weak credentials, it's a common vector for brute-force account takeover. If that machine is compromised, any locally authenticated Claude session/API key on it is exposed too. A lightweight, read-only, opt-in check could help users notice this risk without Anthropic taking on any remediation responsibility.
Proposed Solution
On startup (opt-in via a config flag, e.g. security_advisories: true), Claude Code checks — read-only, no system changes — whether RDP is enabled on the host (Windows only, initial scope) and whether the RDP port (default 3389) appears reachable from outside the local network.
If exposure is detected, print a one-time, non-blocking advisory, e.g.:
"Remote Desktop (RDP) appears to be enabled and reachable from outside your network. This is a common brute-force target. Consider restricting it to a VPN (e.g. Tailscale, WireGuard), enabling Network Level Authentication, or disabling it if unused."
Optionally, tally recent failed RDP logon attempts from the local Windows Security Event Log (Event ID 4625, LogonType 10) over a configurable window (e.g. last 24h/7d) and include the count in the advisory. Read-only access only; if the process lacks permission, skip silently (no elevation prompts). Nothing is transmitted off the local machine — this is purely a local, user-facing notice.
No automatic changes to firewall, RDP settings, or any system configuration — advisory only. Fully opt-in and easy to disable.
Explicitly out of scope: automatically modifying firewall/RDP/system settings, Anthropic operating its own VPN service, inspecting or modifying browser-stored payment data, sending any collected data to Anthropic, and non-Windows/non-RDP protocols (could be a separate proposal for SSH on Linux/macOS).
Alternative Solutions
_No response_
Priority
Low - Nice to have
Feature Category
CLI commands and flags
Use Case Example
_No response_
Additional Context
_No response_