Gryph CLI
Gryph hooks into Claude Code, Cursor, Codex and other agents, logs every action to a local SQLite database and can block risky commands.
- 183 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Writes hooks into Claude Code, Codex, Cursor and other agents' settings and sees the full text of every command, file read and MCP call before it runs
- The SQLite log keeps an agent's action history locally, and on a managed host a separate out-of-process service verifies and signs decisions
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/gryphDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Writes hooks into Claude Code, Codex, Cursor and other agents' settings and sees the full text of every command, file read and MCP call before it runs
- The SQLite log keeps an agent's action history locally, and on a managed host a separate out-of-process service verifies and signs decisions
This is third-party code. Review the repository files before installing.
What it does
Gryph installs with the install.sh one-liner, or via Homebrew, npm or go install, then gryph install finds installed agents by itself and wires hooks into them: PreToolUse and PostToolUse in Claude Code, BeforeTool and AfterTool in Gemini CLI, tool.execute in OpenCode, and equivalents in Codex, Cursor, Windsurf, Devin CLI and Pi Agent. Every file read, shell command and MCP call sends a JSON event to a local SQLite database, with no cloud and no telemetry. gryph logs --live streams agent actions to the terminal in real time, gryph query searches events by file, command, action type or session, and gryph diff shows a file's content before and after an edit. On top of logging, a YAML policy can enforce block, warn, guide or allow rules by action type, file path, command pattern, tool, agent, project and CEL expressions over per-session counters. Gryph protects its own hooks and audit trail with self-protection profiles: gryph doctor shows the protection level of each asset and can repair a changed hook config with --repair. The locked profile on a managed host has a decision service outside the user's process evaluate and sign decisions with a machine key for Claude Code, Codex and Cursor, a key the user's own process never sees.
Who it is for. Developers and security teams who need a full audit trail of an AI agent's actions on a developer machine, and the ability to stop a risky command before it runs.
Good fit when
- An agent makes 47 tool calls in 90 seconds, and the order of reads, commands and edits needs reconstructing after a test failure
- Commands like npm install or curl leave no trace in git diff and need surfacing separately with gryph query --action exec
- Access to .env, *.pem and similar files should happen only under control, logged as an event without storing their content
- Destructive commands and writes to CI configs need blocking by a YAML rule before the agent runs them
- Comparing which agent reads more files, runs more commands or costs more on the same task
Not a fit when
- A centralized server for the whole team at once is needed: Gryph installs and keeps its log locally on each developer machine
- The main agent is only a Copilot extension inside VS Code with no separate CLI: Gryph documents interception for CLI agents and lists its supported hooks explicitly
- Protection against someone who already has root or same-user rights on the machine is required: self-protection does not claim that level
- The policy needs a graphical rule builder instead of YAML
Example request
Install Gryph, hook it into Claude Code in this project and show the last hour of activity with gryph logsLimitations
- Codex hooks fire only with the codex_hooks feature flag enabled in ~/.codex/config.toml, otherwise interception does not happen.
- Devin CLI loads Claude Code hooks from ~/.claude/settings.json by default, so installing Gryph for both agents duplicates events until read_config_from.claude is disabled in Devin's config.
- For Gemini CLI and Windsurf the hook entry point is a root-owned file with no lock, and Gryph only detects tampering with it rather than fully preventing it, unlike the locked profile for Claude Code, Codex and Cursor on a managed host.
- The default export profile strips secret content and exports prompts as keyed digests, not the original text.
How to disable. gryph uninstall removes hooks from every detected agent, and gryph uninstall --purge also wipes the entire SQLite log. The --restore-backup flag restores the agent's original hook config from before Gryph was installed.
FAQ
How is Gryph different from checking git diff after an agent runs?
git diff shows only the final file changes. Gryph logs the full path: what the agent read, which commands it ran, including ones that leave no trace in git, and the order it happened in.
Can a specific command be blocked before it runs?
Yes, through a YAML policy: gryph policy init writes an example rule, gryph policy test --action file_write --path ./secrets/db.env checks it against a specific action, and gryph config set policy.enabled true turns on enforcement.
Does Gryph see passwords and keys inside an agent's commands?
Gryph flags access to files like .env, *.pem and *.key automatically but never stores their content. The default export gives prompts as keyed digests, not the original text.
How do I check Gryph's hooks were not tampered with manually?
gryph doctor shows the protection level of each hook and the profile it earns, and gryph doctor --repair restores the config if tampering is found.
Does Gryph work with several agents at once?
Yes, gryph install hooks into every detected agent at once, and the --agent flag on gryph logs and gryph query filters events by a specific agent, including comparing who reads more files or costs more.
Discussion
No questions or reviews yet.
Related
CLI toolsVigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
HOL Guard checks an AI agent's shell commands, secret reads, MCP calls and package installs before they run and holds risky actions until you decide
A guard on an AI agent's execution path: every tool call gets a PASS, AUTH or BLOCK verdict before it runs
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Gryph (this card) | yes | 183 | |
| HOL Guard | yes | 1,094 | a log and live stream of every agent action with file diffs, not just a block-before-run gate |
| CC Safety Net | no | 2,014 | hooks for nine agents at once and self-protection for the config itself, not just Git and filesystem commands |
README in short
The front page opens with the problem: an agent makes dozens of calls a minute with no visible trace, and offers hooks, a local SQLite database and gryph logs --live as the fix. It then lists supported agents with their hook coverage, a policy section with blocking and an example rule set, and Gryph's own self-protection levels, guard and locked, including a separate decision service on a managed host.