Public alpha · version 0.9.7 · Apache-2.0

Endpoint telemetry for AI coding agents, in the SIEM you already run.

Agentmetry records each tool call Claude Code, Cursor and Codex make on the developer's machine, keeps it in a hash-chained trail a third party can verify, and forwards it to Splunk, Elastic, Google SecOps or Microsoft Sentinel.

Plan a pilotRead the security modelor pip install agentmetry, then agentmetry demo
Each record is bound to the one before it. Orange is the detection. Pick one and try to edit it.

Hashing the session…

Verifying…
index=agentmetry action.type=detection | table _time host agent rule severity
_timehostagentruleseverity
14:02:11lt-ops-031claudecredential-exfilcritical
13:47:52lt-eng-118cursoruntrusted-input-then-risky-actionhigh
11:20:05lt-eng-204codexdestructive-delete-bursthigh
09:58:40lt-eng-118claudesession-tool-bursthigh
Illustrative rows, real rule ids and schema 1.2.0. The Splunk app ships with the pilot.
Detection eventchain verified
{
  "schema_version": "1.2.0",
  "action": { "type": "detection",
              "outcome": "critical" },
  "agent": { "name": "claude" },
  "actor": { "id": "dev_01", "type": "user" },
  "correlation_id": "sess-7f3a",
  "detection": {
    "rule_id": "credential-exfil",
    "severity": "critical",
    "event_ids": ["…52290", "…52291"]
  }
}
Ninety seconds
From one tool call to the SIEM, and the edit it refuses.
The same session agentmetry demo replays on your machine, recorded from its real output.
Read it instead
  1. A coding agent reads a private key, writes a cloud key into a config file, then fetches a URL.
  2. Agentmetry sees it through the agents' own hooks and an MCP stdio proxy, with no kernel driver, and writes a local hash-chained trail.
  3. Agentmetry records each call with its MITRE technique, matches the key with DLP without storing it, and fires one critical credential-exfil finding on the sequence.
  4. With DLP in block mode the same write is denied (dlp:aws_access_key). A policy rule with action: ask makes Claude Code ask first. Both decisions are recorded.
  5. Editing the finding in place makes agentmetry verify fail. An anchor kept off the machine catches a rewrite of the whole trail.
  6. Records go to Splunk, Elastic, Microsoft Sentinel and Google SecOps from a cursor per sink. With Splunk offline its events queue, then drain when it returns.
  7. For fleets, the Enterprise Windows MSI installs the recorder as a service, and Intune scripts set up hooks as the signed-in user.
  8. agentmetry benchmark: 54 cases, 0 missed, 0 false positives.
Every claim on this site has a command behind it
Do not take our word for it.
Each terminal below is a command you can run on your own machine, and what it printed on ours. If a result ever disagrees with this page, the page is wrong.
It detects what it says it detects
$ agentmetry benchmark  cases            54 (26 attack, 28 benign)  rules covered    13  expected firings 26  detected         26  missed           0  false positives  0  All cases behaved as recorded.$ 
agentmetry benchmark:   cases            54 (26 attack, 28 benign)   rules covered    13   expected firings 26   detected         26   missed           0   false positives  0   All cases behaved as recorded.
0 missed, 0 false positives across 54 recorded sessions.
The record has not been edited
$ agentmetry verify --trail agentmetry-trail.jsonl  lines: 56038 total, 56038 chained, 0 legacy  head: seq 56038, sha256 8978eb92a9414bdb…  merkle root: 139f0ec8cd0eb0bc…  anchors: 197 checkpoint(s)    records 1-55666 anchored$ 
agentmetry verify --trail agentmetry-trail.jsonl:   lines: 56038 total, 56038 chained, 0 legacy   head: seq 56038, sha256 8978eb92a9414bdb…   merkle root: 139f0ec8cd0eb0bc…   anchors: 197 checkpoint(s)     records 1-55666 anchored
Chain intact, or the first record that breaks it.
The hooks are really installed
$ agentmetry hooks statusrecorded: antigravity, claude, codex, cursornot installed: codebuddy, kimi, qoder, qwenCOMPLIANT$ 
agentmetry hooks status: recorded: antigravity, claude, codex, cursor not installed: codebuddy, kimi, qoder, qwen COMPLIANT
Exit 0 compliant, 1 needs remediation, 2 undeterminable.
It has run on a real machine
$ agentmetry dogfood  Week  Dates                      Days   Events  Sessions  Detect  Untriaged  Verdict  1     2026-08-30 to 2026-09-05    7     4449        60       6          0  GREEN  2     2026-09-06 to 2026-09-12    7     4639        59       5          0  GREEN  3     2026-09-13 to 2026-09-19    7     1159        21       0          0  GREEN  4     2026-09-20 to 2026-09-26    7     5660         8       3          0  GREEN  5     2026-09-27 to 2026-10-03    7     4741         9       0          0  GREEN  Consecutive green weeks: 5 of 4  Gate PASSED.$ 
agentmetry dogfood:   Week  Dates                      Days   Events  Sessions  Detect  Untriaged  Verdict   1     2026-08-30 to 2026-09-05    7     4449        60       6          0  GREEN   2     2026-09-06 to 2026-09-12    7     4639        59       5          0  GREEN   3     2026-09-13 to 2026-09-19    7     1159        21       0          0  GREEN   4     2026-09-20 to 2026-09-26    7     5660         8       3          0  GREEN   5     2026-09-27 to 2026-10-03    7     4741         9       0          0  GREEN   Consecutive green weeks: 5 of 4   Gate PASSED.
5 consecutive green weeks against an unchanged ruleset, where 4 pass the beta gate.
Output from the maintainer's machine on 8 October 2026. Some lines are left out and long hashes are shortened; nothing else is changed. Yours will differ where it should: your trail, your hooks, your weeks.
Why existing tools miss it
EDR sees powershell.exe. It does not see the agent.
Endpoint, cloud and LLM tools each see part of the picture. None of them records which agent ran which tool, for which developer, in what order, on the laptop.
Process telemetry
process
powershell.exe
parent
Cursor.exe
command line
powershell -c "Get-Content $HOME\.ssh\id_rsa"
user
CORP\dana
host
lt-eng-118
Not in the record
  • Which agent asked for it
  • Which session it belongs to
  • What the agent did next
Values are illustrative. The field names are the recorder's, schema 1.2.0.
CapabilityEDRCNAPPLLM observabilityAgentmetry
Which coding agent ran the commandNoNoPartlyYes
Which developer it ran forProcess ownerNoNoYes
The order of tool calls in a sessionNoNoPartlyYes
What an MCP server handed the modelNoInventory onlyNoSchema digest
A record a third party can verify offlineNoNoNoHash chain
Prompts leave the machinen/an/aYesNo, arguments are hashed
Architecture
Four stages, all on the endpoint.
Each call is hashed at the hook, linked to the one before it, read as part of its session, and sent to every sink from that sink's own cursor.
Every record goes to each sink from that sink's own cursor.
  1. 01
    Capture
    IDE hooks and an MCP proxy see every tool call. Arguments are hashed in the hook process, or keyed per fleet with HMAC-SHA256.
  2. 02
    Chain
    Canonical JSONL, schema 1.2.0, each record bound to the one before it. Detections and triage append to the same chain.
  3. 03
    Detect
    Sequence rules over the session, tagged with MITRE ATT&CK and ATLAS. A credential read then egress is one finding.
  4. 04
    Forward
    From a cursor per sink, with retry. An outage delays events instead of losing them. The local trail stays the source of truth.
Coverage
Nine agents in, six destinations out.
A heartbeat every five minutes says which agents on each machine are recorded, and which are installed but not. Uncovered is the incident.
An illustrative fleet. Each ring is a heartbeat; orange is an agent installed without its hook.
24 machines: 23 recording, 1 with an agent not recorded.
lt-eng-118 · agent not recorded
  • Cursoruncovered
  • Claude Codecovered
  • Qwencovered
  • Codexcovered
From this machine's heartbeat
…
alert: heartbeat.hooks_uncovered = [cursor] on lt-eng-118
Coding agents
  • Cursor
  • Claude Code
  • Codex
  • GitHub Copilot
  • Antigravity
  • Qwen
  • Kimi
  • Qoder
  • CodeBuddy
Plus an MCP stdio audit proxy for servers the agents call.
Not a coding agent? Anything that acts on your machine can be recorded through the ingest API. The agent coverage page says what is supported, possible and impossible, from OpenClaw to the Grok app.
Destinations
  • Splunk HEC
  • Elastic ECS
  • Google SecOps UDM
  • Microsoft Sentinel
  • Webhook
  • Loki (via Grafana Alloy)
Loki: Not a native adapter. Grafana Alloy tails the local JSONL, which keeps the chain envelope that direct push strips.
Product names and marks belong to their owners. No affiliation, partnership, sponsorship or endorsement is claimed.
Deploy
Start on one laptop. Roll out with the tools you already manage.
Open-source sensor
Apache-2.0. Windows, macOS and Linux.
  • pip install agentmetry, then agentmetry hooks install
  • Hash-chained local trail, verifiable offline
  • Every native SIEM sink
  • Try it first with nothing installed: uvx agentmetry demo
  • No account and no telemetry. Nothing leaves until you set a sink
The full recorder. Not a trial.
Read the quickstart
Enterprise pilot
For Windows fleets managed through Intune.
  • Silent MSI. The service runs as a virtual account
  • Intune Remediation, or hooks in the agents' managed locations
  • Per-host Ed25519 signing of forwarded events
  • Splunk app with the fleet dashboard
Not yet EV-signed or run on a customer tenant. We say so up front.
Plan a pilot
Stated limits
What it does not do.
Telling you this now saves a week of your evaluation.
Not a CASB
It records the agents it is wired into. An unmanaged ChatGPT tab, Microsoft 365 Copilot, or an IDE with hooks off is invisible to it.
Not a sandbox
It records and detects. Blocking is limited to pre-execution policy in the hook, and that is off by default.
Not a console
Your SIEM stays the console. Agentmetry adds fields to it, not another screen for the SOC to watch.
A 90-day pilot on your own fleet
Up to 25 developer seats, your SIEM, your Intune tenant. You keep the trail and the detections either way.
Plan a pilotEmail the maintainer