Metadata-Version: 2.4
Name: agentmetry
Version: 0.4.0
Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
Project-URL: Homepage, https://agentmetry.ai
Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
Project-URL: Issues, https://github.com/blitzcrieg1/agentmetry/issues
Project-URL: Changelog, https://github.com/blitzcrieg1/agentmetry/blob/master/CHANGELOG.md
Author: Ioannis L.
License: Apache-2.0
Keywords: agentic-ai,ai-agents,ai-security,audit-log,claude-code,cursor,devsecops,dlp,local-first,mitre-attack,siem
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: System :: Logging
Classifier: Topic :: System :: Monitoring
Requires-Python: >=3.11
Requires-Dist: aiosqlite>=0.20.0
Requires-Dist: fastapi>=0.115.0
Requires-Dist: httpx>=0.28.0
Requires-Dist: mcp>=1.2
Requires-Dist: pydantic-settings>=2.6.0
Requires-Dist: pydantic>=2.9.0
Requires-Dist: pyyaml>=6.0
Requires-Dist: sqlalchemy>=2.0.0
Requires-Dist: tzdata; sys_platform == 'win32'
Requires-Dist: uvicorn[standard]>=0.32.0
Requires-Dist: websockets>=14.0
Provides-Extra: dev
Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff==0.16.0; extra == 'dev'
Description-Content-Type: text/markdown

# Agentmetry

A local-first flight recorder for AI coding agents.

Agentmetry hooks the tool lifecycle of Claude Code, Cursor, Codex and Antigravity,
writes every tool call, approval and denial to a hash-chained JSONL trail on your
machine, and runs sequence detection over the session. A credential read followed
by network egress becomes one finding rather than two unremarkable log lines.

Everything runs locally. There are no cloud calls and no telemetry. Forwarding to
Elastic ECS, Splunk HEC or a webhook exists and is off unless you configure it.

```bash
pip install agentmetry
agentmetry doctor
```

## Check the detection claims yourself

The corpus ships inside the package, so this works from a clean install:

```bash
agentmetry benchmark
```

It replays recorded sessions through the real rule engine and exits non-zero on
any missed rule or any false positive. The benign half is the number that
matters: any tool can fire on an attack, and a feed that cries wolf gets muted.

## What it does not do

- **It is not a CASB.** It records the agents you wire in. An unmanaged browser
  assistant is invisible to it.
- **It is a recorder, not a sandbox.** The only enforcement path is pre-execution
  DLP blocking in the hook.
- **The DLP is regex, not ML.** A starting pack you extend in YAML.
- **It is a public alpha.** Integration surfaces may still change.

Full documentation, the event schema, and the SIEM integration guides are in the
repository.

- Source and issues: https://github.com/blitzcrieg1/agentmetry
- Website: https://agentmetry.ai

Apache-2.0.
