# Agentmetry

> Open-source local-first endpoint sensor that records, detects and can block AI coding agent tool calls, with a verifiable audit trail forwarded to your SIEM.

Agentmetry is an open-source endpoint sensor for AI coding agents, built by independent developer Ioannis Loutsis. It records each tool call that agents such as Claude Code, Cursor, Codex and GitHub Copilot make on the developer's machine, flags risky sequences, and can deny a call that policy forbids before it runs. It is in public alpha (version 0.10.1) under the Apache-2.0 license.

## What It Is

Agentmetry is a security and audit tool for the tool boundary of coding agents. It captures calls through the agents' own hooks and an MCP stdio proxy, without a kernel driver, and writes a local hash-chained JSONL trail. Tool arguments are hashed (SHA-256 by default, or HMAC-SHA256 with a key) so secret values are not stored. Nothing leaves the machine unless a sink is configured.

## How the Workflow Runs

The flow has four stages: capture, chain, detect and forward. Sequence rules work over a session and are tagged with MITRE ATT&CK and, for a subset, ATLAS labels. For example, a credential read followed by network egress produces one critical credential-exfil finding. Blocking is opt-in: DLP and tool policy can deny a call at the hook when set to block, and the default is to log. Records are forwarded from a per-sink cursor with retry, so an outage delays events rather than losing them.

## Verification and Evidence

Each record is bound to the one before it. The verify command checks the chain, anchor publishes checkpoints that a host cannot rewrite, prove gives an inclusion proof for one record, and export writes evidence packs or compliance digests. The project publishes benchmark output of 57 cases with 0 missed and 0 false positives, which the vendor says can be reproduced with the benchmark command.

## Coverage and Deployment

Hooks cover Claude Code, Cursor, Codex, Copilot, Antigravity, Qwen, Kimi, Qoder and CodeBuddy, plus an MCP proxy and an ingest API for other agents. Sinks include Splunk HEC, Elastic ECS, Google SecOps UDM, Microsoft Sentinel, webhooks, and Loki via Grafana Alloy. Windows and Linux are supported, and macOS is in preview. An Enterprise pilot for Windows fleets managed with Intune is offered, including an MSI and a Splunk app.

## Stated Limits

It is not a CASB, sandbox or fleet console. It cannot see unmanaged browser chats or IDEs with hooks off. The local dashboard reads only the trail of the machine it runs on, and fleet views live in the SIEM.

## Features
- Records every coding agent tool call locally in a hash-chained JSONL trail
- Sequence detections mapped to MITRE ATT&CK and ATLAS
- Opt-in pre-execution blocking via DLP and tool policy
- Tamper-evident verification, anchoring, inclusion proofs and evidence packs
- agentmetry scan for MCP servers, skills and rules files
- MCP stdio audit proxy with tools/list fingerprinting
- Heartbeat reporting of agents installed without hooks
- SIEM and webhook forwarding with per-sink cursors and retry
- Local dashboard console for investigating findings
- Claude Code OpenTelemetry ingest
- Sigma rule pack
- Windows MSI and Intune deployment for enterprise pilots

## Integrations
Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, Qwen, Kimi, Qoder, CodeBuddy, MCP, Splunk, Elastic, Microsoft Sentinel, Google SecOps, Grafana Loki, CrewAI, OpenSRE, Microsoft Intune

## Platforms
WINDOWS, MACOS, LINUX, WEB, API, VSC_EXTENSION, CLI

## Pricing
Open Source, Free tier available

## Version
0.10.1

## Links
- Website: https://agentmetry.ai
- Documentation: https://github.com/blitzcrieg1/agentmetry/blob/master/docs/agentmetry-external-ingest.md
- Repository: https://github.com/blitzcrieg1/agentmetry
- EveryDev.ai: https://www.everydev.ai/tools/agentmetry