Cygnux-Labs / Tracekit

# Agents can edit logs. They can't hide the edit.
**Tracekit checks every tool call your agent makes before it runs, signs each call and decision into a hash chain,
and gives you one `.tkb` file per run that anyone can verify offline.**
 8 of 8 tamper attacks caught 480 trials , with a witness (E1) 
 570 of 570 harmful calls stopped 11 classes , 1 false alarm in 738 (E17) 
 < 1 ms added per tool call 0.91 ms at p99 , signer round trip (E9) 
 8 of 8 insider attacks caught a merge gate on every PR (E8) 
Built like **Certificate Transparency**: signed records in an append-only log that independent witnesses cosign 
**Open file format** · verifiers in **Python** and **TypeScript** · **MIT** · runs on your own machines
**Try it · Add it to your agent · What it proves · What's in it · Proof · How it works · Pilot it · Contribute · Docs**
---
When an agent does something it shouldn't, you ask three things: **what did it do, was it allowed, and can you trust
the record?** The agent's own log can't answer the third, because the agent can edit it. Here is one run, recorded
both ways:
 The same run, recorded: the database, the signer, the viewer and both edits are real; the model is scripted. Watch it with sound (1:47) 
In this demo the signer ran as the agent's own user (dev mode), so an agent that knew how could have read the key and
re-signed the log. Run the signer where the agent can't reach it, with a witness, and it can't.
## Try it
 [code] 
No API key, and nothing to install with uv. From an empty cache on a Mac it took 5
seconds (10 with `pip install tracekit-ai` in a fresh venv). The package is `tracekit-ai`: `tracekit` on PyPI is an
unrelated project. A scripted agent makes three calls, and you should see:
 [code] 
The delete was denied before it ran, the held call ran after an approval, and the run verified. Then the demo rewrote
the denial as allowed in a copy, and verification failed at the record it changed.
## Add it to your agent
Three lines:
 [code] 
 [code] 
 [code] 
`tracekit.instrument()` starts a dev signer (or reuses the running one) and gates and records every tool and model call
of the frameworks it finds. `tracekit last` exports your latest run, verifies it and says where it is.
`tracekit view --dev` shows every run. On a clean machine the LangGraph example (a mock model, no API key) installed,
ran and verified in 27 seconds: `examples/v2/clean-machine.sh langchain`.
 Stable: Claude Code, the OpenAI Agents SDK, LangChain / LangGraph, the Claude Agent SDK and MCP. Experimental: Codex
CLI, Cursor, Gemini CLI, CrewAI, Browser Use, Pydantic AI, Google ADK, Haystack, LlamaIndex, Microsoft Agent
Framework, Strands Agents, the Vercel AI SDK, NVIDIA OpenShell, E2B, microsandbox, agentgateway, Wassette, LiteLLM's MCP
gateway, Docker's MCP Gateway and the TypeScript SDK.
In NVIDIA OpenShell sandboxes, Tracekit decides and signs each HTTP request OpenShell lets out, and signs OpenShell's
own blocks, process events and policy changes into the