Bravish (@bravish_) on X

What it is

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents, announced by Bravish (@bravish_) on X for Cygnux Labs. It checks each tool call before it runs, signs calls and decisions into a hash chain from a signer the agent cannot control, and writes one .tkb file per run that can be verified offline. The authors say they are looking for contributors and design partners. The post links a GitHub repo (Cygnux-Labs) and a paper at arxiv.org/abs/2609.35659.

How it works

• Pre-call decision: policy packs cover coding, server, browser, SQL, HTTP, cloud and payments agents. Each call is allowed, denied or held for a person, and a denial tells the agent which rule stopped it.
• Argument provenance: if a recipient, payee or upload host came only from untrusted content (web page, email, ticket), the signer holds the call for a person.
• Sequence rules: a pattern such as reading .env then uploading to a paste site opens a signed incident. The run can be held or quarantined, and new runs from the same owner inherit the hold.
• Approvals: bound to the exact arguments and usable once. They can be given from the CLI, a web page with OIDC and passkeys, or Slack. A reviewer agent can clear routine ones within policy bounds.
• Gaps: a missed event, or an approved call that never reported back, becomes a signed gap. An egress observer outside the agent flags network traffic no call explains. If the signer is down, calls are blocked.
• Trust levels: independent witnesses cosign checkpoints and a monitor watches the log. Reports are labelled dev, witnessed, or witnessed+monitored.
• Root cause: tracekit why replays a run with each input removed, serving tools from the recording so nothing real is re-sent.
• Format: evidence format v2 uses JCS, Ed25519, RFC 6962 trees and C2SP checkpoints. It has published test vectors, and Python and TypeScript verifiers agree on every case.

Reported results: 8/8 tamper attacks caught (480 trials, with a witness), 462/462 harmful calls stopped across 11 classes with 1 false alarm in 668, 8/8 insider attacks caught, and under 1 ms added per call (0.91 ms at p99). These are the authors' own figures.

What to do

Install with pip install tracekit-ai or npm install @cygnuxlabs/tracekit. Add this as the first line of the agent:

import tracekit; tracekit.instrument()

Then check the result of a run:

tracekit last

Try it with nothing installed:

uvx --from tracekit-ai tracekit demo --server

Start a signer without Python:

npx @cygnuxlabs/tracekit up

tracekit view lists runs with verifier verdicts. tracekit view --dev names every command and file a coding agent touched. Adapters cover 13 targets, including Claude Code, Codex CLI, Cursor, Gemini CLI, OpenAI Agents SDK, Claude Agent SDK, LangChain, LangGraph, MCP, CrewAI, Browser Use, Vercel AI SDK and OpenTelemetry. Deployment options are a laptop, a separate OS user, a container or Kubernetes sidecar, or a central signer on Postgres.

Caveats

The page lists these limits itself:

• A verified bundle shows the record was not changed. It does not show intent, that every action was captured, or that a reported tool result was real.
• Experimental parts: why, detection and containment, agent approvers, gateways, witnesses, Postgres and the TypeScript client. docs/support.md lists the stable core.
• Anything that never crosses a capture point is missed: subprocesses, background jobs, code that skips the adapter. Gateways and the egress observer cover more.
• Policy rules are tripwires, and a determined agent can reword a command. The protection is a signer the agent cannot reach.
• Dev mode protects nothing against an agent running as the same user. Strong guarantees need a separate user, sidecar or central signer, plus an independent witness.
• tracekit why re-runs the agent 20 to 40 times with your own model key. It measures the program on that task, not the model's reasons.
• Timing, size and count metadata still leak. The free public witness is not live yet. Intel Macs and Alpine need Python for the signer.

Full limits are in docs/limits.md.