AtlasBurn
Paid
AI-native teams tracking variable inference costs
Agentmetry
FreeOpen SourceSelf-Hosted
Your developer shipped Cursor into a production repo with real credentials, and your EDR saw a process — not the sequence where the agent read a private key and then made a network call three seconds later. Agentmetry exists because that gap is where the incident lives.
Similar tools
AtlasBurnPaidAtlasBurn monitors token usage and cost distribution across OpenAI, Anthropic, Gemini, and AWS…
Selfship.aiPaidThe observe-diagnose-fix-verify cycle runs on live traffic without you assigning tasks or…
SemelbaseFreemiumThe vendor positions Semelbase as a ledger and routing layer that sits between your agents and…
ArgosvixFreemiumArgosvix sits between your application and your LLM provider calls, scoring each response for…
Get This Tool
License: Apache-2.0 Any use incl. commercial
Local-run terms: Users may install via pip, clone the repo, run locally, modify, and use in commercial settings under Apache-2.0 terms.
Screenshots 1
Pricing
- Model
- Free
Summary
Agentmetry is an open-source, local-only session recorder for AI coding agents — Cursor, Claude Code, Codex, Antigravity — that hooks at the tool boundary, tags every call with MITRE ATT&CK, and fires correlated alerts when a chain of events matches a known attack pattern. The trail is a hash-chained JSONL file that never leaves your machine; Merkle proofs let you hand a single-event proof to an auditor without forwarding the full log. It ships with 15+ sequence detection rules and three native SIEM sinks — Elastic ECS, Splunk HEC, and webhook. The ceiling is the ruleset: detection coverage is what the project's 15+ rules plus your custom additions cover, and anything outside that scope passes through silently.
Bottom line: Pick this when your security team needs an evidence trail for agents already running in developer machines and you cannot route that data through a cloud vendor — but if you need behavioral coverage across agent types the project has not yet instrumented, you will be writing detection rules before you get your first alert.
Find your fit
Before you choose Agentmetry
More options in LLM Observability. Compare pricing, platforms, and features side by side.
Argosvix
Freemium
Developers monitoring production LLM usage
Pros
- Sequence correlation across tool calls — not just per-event tagging — so the credential-read-then-egress pattern that looks like two unrelated log lines fires as a single critical alert instead of noise your analyst has to manually connect.
- Local DLP scans tool arguments before execution and before storage, which means an AWS key or GitHub PAT that would have been written to a log file or passed to a network call gets caught and optionally blocked at the hook layer.
- Hash-chained JSONL trail with Merkle proofs, so you can hand an auditor a 1.2 KB proof for a single event without forwarding an 8 MB log file — which matters when the log contains sensitive argument data from other sessions.
- 0 cloud calls and a self-hosted option, so EU teams and regulated environments that cannot route agent telemetry through a vendor's infrastructure get a compliant evidence trail without building one from scratch.
- Native sinks for Elastic ECS and Splunk HEC, so the agent event trail lands in the SIEM your SOC already queries rather than requiring a separate dashboard and alert pipeline.
Cons
- Detection coverage stops at the 15+ built-in sequence rules plus whatever your team adds. An agent behavior pattern outside that ruleset — a novel exfiltration chain, an agent type not yet instrumented — passes through with no alert. Teams with broad or evolving agent fleets end up maintaining a custom rule library before the tool covers their actual threat surface.
- Hook coverage is bounded to Cursor, Claude Code, Codex, Antigravity, and MCP stdio servers. Any agent that surfaces tool calls through a different interface is not recorded. Teams running a mixed fleet that includes unrecognized agent tools get a partial trail — which is worse than a known gap when the incident involves the unmonitored agent.
- Fleet-wide collection requires the team to stand up their own forwarding pipeline to Elastic or Splunk; there is no centralized management layer. At a dozen developer machines this is a configuration task. At hundreds of machines it becomes an infrastructure project, at which point teams with existing endpoint telemetry platforms evaluate whether a dedicated agent monitor justifies the operational overhead against extending their current EDR with custom process rules.
About
- Platforms
- Local machine (Linux/macOS/Windows via Python)
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- August 14, 2026
Best For
Who it's for
- SOC and DevSecOps teams
- Platform engineers needing incident evidence trails
- EU teams requiring on-premise audit logs
- Security engineers governing unsanctioned agent tools
What it does well
- Auditing agent actions in repositories after incidents
- Detecting credential exfiltration sequences in agent sessions
- Generating process evidence for EU AI auditors on local hardware
- Forwarding agent events to existing Elastic or Splunk deployments
Integrations
Frequently Asked Questions
- Is Agentmetry free?
- Agentmetry offers a free option. Hosting, model usage, or optional services may have separate costs; check the pricing details and official terms.
- Is Agentmetry open source?
- Yes. Agentmetry is open source.
- Can I self-host Agentmetry?
- Yes. Agentmetry supports self-hosting on your own infrastructure.
- What platforms does Agentmetry support?
- Agentmetry is available on: Local machine (Linux/macOS/Windows via Python).
Curated lists that include this category
The gap EDR tools miss
Your developer shipped Cursor into a production repo with real credentials, and your EDR saw a process — not the sequence where the agent read a private key and then made a network call three seconds later. Agentmetry records every tool call from Cursor, Claude Code, Codex, and Antigravity at the boundary, tags each call with MITRE ATT&CK, and fires an alert when the chain matches a known attack pattern.
How the trail works
The output is a hash-chained JSONL file that stays on the local machine. Merkle proofs let an auditor receive a single-event proof without the full log. Fifteen-plus built-in sequence rules ship with the tool, along with direct export to Elastic ECS, Splunk HEC, and webhook sinks. Local DLP checks tool arguments before execution or storage, so an AWS key or GitHub PAT can be caught and optionally blocked at the hook.
Where coverage ends
Detection stops at the supplied rules plus any added by the team. An agent type or behavior pattern outside that set passes without an alert. Hook support is limited to the listed agents and MCP stdio servers; other interfaces are not recorded.
Who it is for / who should skip it
Best for SOC and DevSecOps teams, platform engineers needing incident evidence, EU teams that must keep audit logs on-premise, and security engineers who govern unsanctioned agent tools. Teams running a mixed fleet of unrecognized agents or needing coverage beyond the current ruleset will need to maintain custom rules before the tool matches their actual threat surface.
Contribute
- Work on Agentmetry? Claim this listing.
- Embed a badge for your README or site.
Sign in to rate this tool or suggest an edit.