Chainloop CLI
A CLI that records Claude Code, Codex and Cursor sessions, signs them on git push and checks them against Rego policies.
- 614 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- chainloop trace installs git and agent hooks, reads sessions and sends attested records to an external registry or Chainloop Cloud.
- Policies with gate: true block pushes and builds, so a mistake in a rule stops the team's work.
Install
- Works in
Manual install
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --ossREADME command for the open-source build. Afterwards chainloop trace init in a repository installs the session recording hooks.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- chainloop trace installs git and agent hooks, reads sessions and sends attested records to an external registry or Chainloop Cloud.
- Policies with gate: true block pushes and builds, so a mistake in a rule stops the team's work.
This is third-party code. Review the repository files before installing.
What it does
Chainloop gathers software delivery data into one graph: AI agent sessions, pull requests, builds, SBOMs, scans and test reports become signed records in your OCI registry or bucket. Each record links to a commit and a release. Rules live in git, and a build that breaks them fails. `chainloop trace` serves agents. `chainloop trace init` installs git hooks (`pre-push`, `post-commit`, `commit-msg`, `post-rewrite`) and agent hooks, then writes `.chainloop.yml`. Sessions of Claude Code, OpenCode, Codex and Cursor are recorded on your machine, secrets are redacted, AI and human lines are attributed, and on `git push` the session is attested with a signature. For Codex use `chainloop trace init --codex`. `requireTrace: true` in `.chainloop.yml` blocks a push with no recorded session. In CI, `chainloop attestation` does the same for SBOMs, scans, test reports and SLSA provenance. A YAML contract says what each build must hand in, and policies in Rego or WASM say what a record must satisfy: approved models only, no secrets in prompts, tests passing, an SBOM for every release. `gate: false` only reports a violation, while `gate: true` blocks. The agent that opened the pull request reads the failure report and tries again.
Who it is for. Engineering and security teams that need a verifiable trail of AI agent and pipeline actions: which models wrote the code, what shipped in a release and whether the policies passed.
Good fit when
- A company needs to know which agent and model wrote a change and keep the session record next to the commit.
- A release with no SBOM or with a critical vulnerability must be blocked at build time.
- An audit requires signed compliance evidence in in-toto format.
- Quality rules for agents have to be written as code and versioned with the project.
- An agent should see the reasons for a failed CI check itself and fix its work in a loop.
Not a fit when
- You need one local check on commit: the platform is built around a registry, signatures and policies and needs setup.
- Sessions must not be stored even locally: `chainloop trace` records them on the developer machine until `git push`.
- A plain pre-commit linter is enough: contracts and Rego policies would be excessive.
Example request
Install chainloop, run chainloop trace init in this repository and explain what session data will go into the record on git push.Limitations
The CLI sends records to Chainloop Cloud by default: sign-up is required, free for 14 days. Self-hosting is free and unlimited and installs with Docker Compose or Helm.
The pull request merge check, the AI Session Score and model reviewers belong to the paid Chainloop Platform. The open-source build installs with the `--oss` flag.
`chainloop trace` support is verified for Claude Code, OpenCode, Codex and Cursor; a detailed list of features and limits is in app/cli/internal/trace/README.md.
How to disable. Run `chainloop trace uninstall` to remove the git and agent hooks, and delete `.chainloop.yml`. Remove the `chainloop attestation` jobs from CI.
FAQ
How do I install Chainloop?
With `curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss`. The installer checks checksums, and the signature too when cosign is installed. A ready binary is on the releases page.
What does chainloop trace record?
Sessions of Claude Code, OpenCode, Codex and Cursor, with secrets redacted and lines attributed to AI or human. The attested record goes out on `git push`; hand-written commits pass untouched.
What happens when a policy is violated?
With `gate: true` the build fails and violations are signed into the record. With `gate: false` the policy only reports. Any bypass through `--exception-bypass-policy-check` also lands in the record.
Does it cost anything?
The open-source version under Apache 2.0 is free, self-hosting included. The cloud service is free for 14 days, and the PR check and session scoring belong to the paid platform.
How do I write my own policy?
`chainloop policy develop init --name <name>` creates a YAML and a Rego file, then `lint` checks it and `eval` runs it on a material such as an SBOM.
Discussion
No questions or reviews yet.
Related
CLI toolsA CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
Tracekit checks an AI agent's tool calls before they run and keeps a signed log whose tampering shows up in an offline check
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
cplt runs AI coding agents in a kernel sandbox: code gets edited, SSH keys and pushes to the default branch stay out of reach.
Agents Shipgate shows in a pull request how an agent permissions and tools changed before the changes reach main
README in short
The README explains the idea of defining rules once and enforcing them everywhere, shows a contract and a Rego policy, describes the agent verification loop and gives a quick start with two paths: collecting signals from CI and recording AI sessions. Component tables, use cases, install security and self-hosting follow.