A flight recorder your agent can't rewrite

What it does Tracekit instruments your AI agent (one call to tracekit.instrument()) and gates every tool and model call before it runs — denying risky commands, holding ambiguous ones for human approval, and signing each decision into an append-only hash chain. Each run produces a single .tkb file that anyone can verify offline, in Python or TypeScript. It works with Claude Code, the OpenAI Agents SDK, LangChain/LangGraph, the Claude Agent SDK, MCP, and a long tail of experimental integrations.

The interesting bit The design borrows from Certificate Transparency: signed records in an append-only log, cosigned by independent witnesses, so a rewrite after the fact fails verification at the exact record that changed. The README’s demo is refreshingly honest — it shows an agent deleting 43 orders, editing both its own log and Tracekit’s record, and getting caught at record 7. It also plainly states that in dev mode the agent could reach the signing key; the guarantees only hold when the signer runs where the agent can’t.

Key highlights

• Policy gates run before execution: the demo denies a piped-to-shell installer, credential reads, and a force-push to main before they happen.
• Reported numbers: 8/8 tamper attacks caught across 480 trials, 833/833 harmful calls stopped with 1 false alarm in 887, and 0.91 ms added per tool call at p99.
• tracekit audit replays your existing Claude Code sessions locally and shows what would have been denied — nothing installed, nothing leaves the machine.
• Open file format, MIT licence, verifiers in Python and TypeScript, runs fully offline.

Caveats

• The headline guarantees depend on deployment: with a dev signer running as the agent’s user, the agent could re-sign the log. You need the signer out of reach plus a witness for real proof.
• Many integrations (Cursor, Gemini CLI, CrewAI, Vercel AI SDK, the TypeScript SDK, and more) are labelled experimental.
• The demo uses a scripted model, not a real one — the tooling and edits are real, the agent isn’t.

Verdict Worth a look if you run agents with real permissions and need an audit trail that survives the agent itself. If your agent only drafts emails, this is a lot of machinery for a problem you don’t have.