Get This Tool
Agentmetry
Pricing
- Model
- Free
Summary
Your developer shipped Cursor into a production repo with real credentials, and your EDR saw a process — not the sequence where the agent read a private key and then made a network call three seconds later. Agentmetry exists because that gap is where the incident lives.
Agentmetry is an open-source, local-only session recorder for AI coding agents — Cursor, Claude Code, Codex, Antigravity — that hooks at the tool boundary, tags every call with MITRE ATT&CK, and fires correlated alerts when a chain of events matches a known attack pattern. The trail is a hash-chained JSONL file that never leaves your machine; Merkle proofs let you hand a single-event proof to an auditor without forwarding the full log. It ships with 15+ sequence detection rules and three native SIEM sinks — Elastic ECS, Splunk HEC, and webhook. The ceiling is the ruleset: detection coverage is what the project's 15+ rules plus your custom additions cover, and anything outside that scope passes through silently.
Bottom line: Pick this when your security team needs an evidence trail for agents already running in developer machines and you cannot route that data through a cloud vendor — but if you need behavioral coverage across agent types the project has not yet instrumented, you will be writing detection rules before you get your first alert.
Community Performance Report Card
No community ratings yet. Be the first to rate this tool!
Pros
Sign in to edit- Sequence correlation across tool calls — not just per-event tagging — so the credential-read-then-egress pattern that looks like two unrelated log lines fires as a single critical alert instead of noise your analyst has to manually connect.
- Local DLP scans tool arguments before execution and before storage, which means an AWS key or GitHub PAT that would have been written to a log file or passed to a network call gets caught and optionally blocked at the hook layer.
- Hash-chained JSONL trail with Merkle proofs, so you can hand an auditor a 1.2 KB proof for a single event without forwarding an 8 MB log file — which matters when the log contains sensitive argument data from other sessions.
- 0 cloud calls and a self-hosted option, so EU teams and regulated environments that cannot route agent telemetry through a vendor's infrastructure get a compliant evidence trail without building one from scratch.
- Native sinks for Elastic ECS and Splunk HEC, so the agent event trail lands in the SIEM your SOC already queries rather than requiring a separate dashboard and alert pipeline.
Cons
Sign in to edit- Detection coverage stops at the 15+ built-in sequence rules plus whatever your team adds. An agent behavior pattern outside that ruleset — a novel exfiltration chain, an agent type not yet instrumented — passes through with no alert. Teams with broad or evolving agent fleets end up maintaining a custom rule library before the tool covers their actual threat surface.
- Hook coverage is bounded to Cursor, Claude Code, Codex, Antigravity, and MCP stdio servers. Any agent that surfaces tool calls through a different interface is not recorded. Teams running a mixed fleet that includes unrecognized agent tools get a partial trail — which is worse than a known gap when the incident involves the unmonitored agent.
- Fleet-wide collection requires the team to stand up their own forwarding pipeline to Elastic or Splunk; there is no centralized management layer. At a dozen developer machines this is a configuration task. At hundreds of machines it becomes an infrastructure project, at which point teams with existing endpoint telemetry platforms evaluate whether a dedicated agent monitor justifies the operational overhead against extending their current EDR with custom process rules.
About
- Platforms
- Local machine (Linux/macOS/Windows via Python)
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- 2026-08-14T04:22:35.662Z
Best For
Who it's for
- SOC and DevSecOps teams
- Platform engineers needing incident evidence trails
- EU teams requiring on-premise audit logs
- Security engineers governing unsanctioned agent tools
What it does well
- Auditing agent actions in repositories after incidents
- Detecting credential exfiltration sequences in agent sessions
- Generating process evidence for EU AI auditors on local hardware
- Forwarding agent events to existing Elastic or Splunk deployments
Integrations
Add notes, reviews, and benchmarks so the next visitor gets a clearer picture.
Compare Agentmetry
Spotted incorrect or missing data? Join our community of contributors.
Sign Up to ContributeFrequently Asked Questions
- Is Agentmetry free?
- Yes — Agentmetry is fully free to use. There is no paid tier.
- Is Agentmetry open source?
- Yes. Agentmetry is open source.
- Can I self-host Agentmetry?
- Yes. Agentmetry supports self-hosting on your own infrastructure.
- What platforms does Agentmetry support?
- Agentmetry is available on: Local machine (Linux/macOS/Windows via Python).
Best Agentmetry alternatives →
Curated lists that include this category
The gap EDR tools miss
Your developer shipped Cursor into a production repo with real credentials, and your EDR saw a process — not the sequence where the agent read a private key and then made a network call three seconds later. Agentmetry records every tool call from Cursor, Claude Code, Codex, and Antigravity at the boundary, tags each call with MITRE ATT&CK, and fires an alert when the chain matches a known attack pattern.
How the trail works
The output is a hash-chained JSONL file that stays on the local machine. Merkle proofs let an auditor receive a single-event proof without the full log. Fifteen-plus built-in sequence rules ship with the tool, along with direct export to Elastic ECS, Splunk HEC, and webhook sinks. Local DLP checks tool arguments before execution or storage, so an AWS key or GitHub PAT can be caught and optionally blocked at the hook.
Where coverage ends
Detection stops at the supplied rules plus any added by the team. An agent type or behavior pattern outside that set passes without an alert. Hook support is limited to the listed agents and MCP stdio servers; other interfaces are not recorded.
Who it is for / who should skip it
Best for SOC and DevSecOps teams, platform engineers needing incident evidence, EU teams that must keep audit logs on-premise, and security engineers who govern unsanctioned agent tools. Teams running a mixed fleet of unrecognized agents or needing coverage beyond the current ruleset will need to maintain custom rules before the tool matches their actual threat surface.