Tracekit CLI
Tracekit checks an AI agent's tool calls before they run and keeps a signed log whose tampering shows up in an offline check
- 468 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Changes the agent's hooks and runs a local signing service that every tool call passes through
- The run log holds the calls and their results, including shell commands and file access
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/tracekitDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Changes the agent's hooks and runs a local signing service that every tool call passes through
- The run log holds the calls and their results, including shell commands and file access
This is third-party code. Review the repository files before installing.
What it does
Tracekit installs as the `tracekit-ai` PyPI package and sits between an agent and its tools. Before each call a signing service decides to allow it, deny it or hold it for a person. The rules come in packs for shell, files, SQL, HTTP, cloud CLIs, browsers, email, messaging, payments, secrets and MCP. Every call, decision and result goes into one chain of signed hashes per agent run. A run exports to a `.tkb` file, and `tracekit verify` checks it offline against the keys you pinned. Editing, deleting, swapping or inserting a record breaks verification at that record. For Claude Code, `tracekit init --dev --v2` wires its hooks to a signer in development mode. The `--agent codex`, `cursor`, `gemini` or `opencode` flags enable the other agents, still as experimental. The `tracekit audit --since 7d` command reads your Claude Code sessions on this machine and shows which calls Tracekit would have denied or held: nothing is installed in the agent and nothing leaves the machine.
Who it is for. Teams whose agent acts on real systems (shell, databases, email, payments, cloud) and who need a record an auditor or a customer can trust.
Good fit when
- The agent deletes data or sends email, and risky calls have to wait for a person's approval
- A customer or auditor asks for proof that the agent's log was not edited after the fact
- A week of Claude Code sessions has piled up, and `tracekit audit --since 7d` shows the calls the rules would have stopped
- After an incident you need to find where the agent strayed from the request: `tracekit analyze --v2` compares what was asked, what the agent said and what ran
Not a fit when
- The agent only reads data or runs in a throwaway sandbox: a plain tracer is enough
- You are debugging a prototype: OpenTelemetry, Langfuse or LangSmith fit that job
- The agent's code skips the hooks and the SDK: Tracekit neither sees nor stops those calls
Example request
Install Tracekit, connect it to Claude Code and show which calls from the past week it would have deniedLimitations
- In development mode (`--dev`) the signing service runs as your user, so an agent with the same rights can read the key and re-sign the log. Real protection needs a signer out of the agent's reach and an independent witness, and no public witness runs yet.
- A verified run proves the records are intact, not the agent's intent. A subprocess a hook never sees leaves no record.
- The rules match command text and tool names, so a determined agent can reword a command.
- Claude Code, the OpenAI Agents SDK, LangChain and LangGraph, the Claude Agent SDK and MCP are stable; the rest is experimental. Python 3.9 to 3.13 is required, and framework integrations need 3.10 or newer.
How to disable. Tracekit's hooks live in the agent's settings: remove those entries by hand, then run `pip uninstall tracekit-ai`. The project's documentation has no dedicated rollback command.
FAQ
How do I set up Tracekit in Claude Code?
Run `pip install tracekit-ai`, then `tracekit init --dev --v2` in the project folder: it wires Claude Code's hooks to a signer in development mode. `tracekit doctor` checks the setup and `tracekit last` shows the latest run.
How is Tracekit different from Langfuse or OpenTelemetry?
Tracers show what happened and serve debugging. Tracekit stops risky calls before they run and signs the records, so an edit to the log shows up on verification. For debugging a prototype the project's documentation recommends a plain tracer.
Can I try it without installing anything in my agent?
Yes: `uvx --from tracekit-ai tracekit demo --server` runs a scripted scenario with no API key. The agent makes three calls, the dangerous command is denied, and a copy of the log with the denial rewritten fails verification.
What happens if the agent tries to edit a record in the log?
`tracekit verify` on the `.tkb` file shows the record where the hash stops matching. A truncated tail or a re-signing with a stolen key is caught only by an independent witness, which is still experimental.
Which agents does Tracekit work with?
Claude Code, the OpenAI Agents SDK, LangChain and LangGraph, the Claude Agent SDK and MCP are stable. Codex CLI, Cursor, Gemini CLI, CrewAI, Browser Use and others are marked experimental. Setup for each is described in the project wiki.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A Claude Code plugin signs every tool call with an Ed25519 key and keeps a log that can be verified offline
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
An agentic web scanner: terminal workspace, six stages from recon to report, browser validation of findings, REST and MCP
VibeKit runs Claude Code, Codex and other CLI agents through a proxy that masks secrets in replies, keeps a log and can hold the agent in Docker
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Tracekit (this card) | no | 468 | |
| HOL Guard | yes | 1,072 | a local approval queue and package checks, with no signed-chain log that third parties can verify |
| CC Safety Net | no | 1,932 | a hook for Git and file system commands only, with no signature-checked log |
README in short
The front page opens with a short demo in which an agent deletes orders and edits its own log, and verification catches the edit at record 7. It continues with a three-line setup, a table of integrations with 25 agents and frameworks, three guarantees with their conditions and limits, measured results from the experiments and an account of how the signer works. Commands and wiki links close the page.