Bravish (@bravish_) on X

What it claims

Tracekit 1.2.3 is a recorder for AI agent runs. It is built on the premise that an agent's own logs can be edited by whatever controls the agent. A separate signer, which the agent cannot reach, checks each tool call before it runs. It writes the call and the decision into a signed hash chain. Each run produces one .tkb bundle that anyone can verify offline. The project is by Cygnux Labs, and an arXiv paper (2609.35659) accompanies it.

How it works

Adapters capture tool calls, model calls and approvals. The signer applies a policy pack for one of these agent types: coding, server, browser, SQL, HTTP, cloud or payments. Each call is allowed, denied or held for a person. A denied call returns the rule that stopped it.

The signer also tracks where each argument came from. If an email recipient, payee or upload host came only from untrusted content such as a web page, email or ticket, the call is held. This happens regardless of how the injection is worded.

Sequence rules, such as reading .env and then uploading to a paste site, open a signed incident. The run can then be held or quarantined, and later runs from the same owner inherit the hold. Missed events and approved calls that never report back become signed gaps. If the signer is down, calls are blocked by default.

Approvals bind to exact arguments and work once. They can come from the CLI, a web page with OIDC and passkeys, or Slack. A reviewer agent can clear routine approvals within policy bounds.

tracekit why replays a run 20 to 40 times with each input removed. It serves tool results from the recording, so no real calls are re-sent, and signs what it finds.

flowchart LR
  A[Agent + adapter] -->|tool call| S[Signer, separate user/sidecar]
  S --> P{Policy + provenance}
  P -->|allow| E[Executor holds keys]
  P -->|deny| A
  P -->|hold| H[Human / reviewer approval]
  H --> E
  S --> C[Hash chain + checkpoints]
  W[Independent witnesses] --> C

The evidence format v2 is specified, with test vectors. It uses JCS, Ed25519, RFC 6962 Merkle trees and C2SP checkpoints. Two independent verifiers, one in Python and one in TypeScript, agree on every test case. Each report states a trust level: dev, witnessed, or witnessed+monitored.

Evidence

The post gives these results. The settings beyond what is quoted here are not described.

• Tamper attacks: 8 of 8 caught over 480 trials, with a witness.
• Harmful calls: 462 of 462 stopped across 11 classes, with 1 false alarm in 668.
• Overhead: under 1 ms per tool call, 0.91 ms at p99.
• Insider attacks: 8 of 8 caught, enforced as a merge gate on every PR.

A demo video shows a prompt injection that leads a support agent to delete 43 orders. The cover-up then edits both the agent's log and Tracekit's records. The run is marked FAILED, and the altered record is named.

How to use it

pip install tracekit-ai
npm install @cygnuxlabs/tracekit

import tracekit; tracekit.instrument()

tracekit last
tracekit view
tracekit view --dev
uvx --from tracekit-ai tracekit demo --server
npx @cygnuxlabs/tracekit up

The instrument() call goes on the first line of the agent. The npx command starts a signer without Python.

Supported integrations are Claude Code, Codex CLI, Cursor, Gemini CLI, the OpenAI Agents SDK, the Claude Agent SDK, LangChain, LangGraph, MCP, CrewAI, Browser Use, the Vercel AI SDK and OpenTelemetry. Python and TypeScript SDKs are also available.

Deployment options are a laptop, a separate OS user, a container or Kubernetes sidecar, or a central signer on Postgres. A tool executor, an MCP gateway and an LLM gateway hold credentials outside the agent process. Packages ship with build provenance, SBOMs and a signed container image.

Limits

These limits are stated by the authors.

• A verified bundle proves the record was not changed. It does not prove intent, completeness, or that reported tool results were real.
• Several features are experimental and may change: why, detection and containment, agent approvers, the gateways, witnesses, Postgres and the TypeScript client. docs/support.md lists the stable core.
• Activity that never crosses a capture point is missed. This includes subprocesses, background jobs and code that skips the adapter.
• Policy rules are tripwires that a determined agent can get around by rewording a command.
• Dev mode protects nothing against an agent running as the same user. Strong guarantees need a separate user, sidecar or central signer, plus an independent witness.
• why uses the user's own model key. It measures program behaviour on that task, not the model's reasons.
• Timing, size and count metadata still leaks.
• The free public witness was not live at release.
• Intel Macs and Alpine need Python for the signer.

The full list is in docs/limits.md.