Sentinel-class monitor · for AI agents
Proof of what your AI actually did.
Your organisation's agents write files, run commands and reach the network all day. Siphrix gives the people answerable for that — security, compliance, the CISO — the record: every action, captured from outside the agent on every enrolled machine, in a chain where removing a single entry breaks every hash after it. Coverage gaps are named, evidence exports verify offline, and it never blocks — so it deploys in a day.
Copilot · coding agents
Observability shows you a claim. Siphrix gives you evidence.
Tracing tools ask the agent to report on itself. When an agent is compromised — prompt injection, a hijacked tool call, or simply a bug — the trace describing its behaviour is written by the very code that misbehaved. A self-reported trace is a claim. Siphrix records from outside the agent, where the action is about to happen.
Recorded from outside
Siphrix hooks the agent's harness, so the record never depends on the agent being honest, correct or uncompromised. It sees the action — not the agent's account of it.
A chain, not a log
Every entry carries a SHA-256 over its own fields and the hash before it. Remove one entry and every hash after it stops matching. One click re-walks the chain and says so.
Proof someone else can check
Send an auditor a signed, expiring link. They open it with no account and see the attestation — never your files, never your commands. Revoke every link instantly.
One record, every surface
Terminal, VS Code and browser on every enrolled machine report into the same record. Coding agents, ChatGPT, Claude and Gemini — one place that knows what all of them did.
The auditor's language
The report names the controls it serves: ISO/IEC 42001 A.6.2.8 — recording of event logs — plus A.6.2.6 and SOC 2 CC7.2. Evidence you can file, not a screenshot.
It never blocks
An observer must not break the thing it observes. Nothing is stopped by default — which is why Siphrix goes in during a sprint, not a procurement cycle.
Your AI already acts in your name. Nobody is watching.
Every tool your teams connect can touch files, reach the internet and move money. Siphrix is the page your security team checks afterwards — and the alarm that fires before they have to.
It deletes files
One misread instruction and a folder is gone — and without a record, you can't say which agent did it, or when, or why.
■ SEVERITY: CRITICALIt leaks data
A pasted secret, an uploaded document, a message to the wrong place. Siphrix knows the shape of a leak and writes the warning instantly.
▲ SEVERITY: HIGHIt spends money
Payments, subscriptions, purchases — agents can do all of it. Every attempt becomes an entry; the dangerous ones rise to the top.
■ SEVERITY: CRITICALConnect once. The record writes itself.
Link
Each machine enrols with one connection code from your console. One click for browsers and editors, one line for coding agents — Siphrix runs beside your tools, never in front of them.
$ siphrix agent-setup # linked.
Record
Files touched, commands run, sites reached, data shared — each becomes one clean, private entry. Metadata only. Never content.
✓ 09:42 http_request · recorded
Alert
Anything dangerous-looking is flagged by severity, with the reason in plain language — the moment it happens.
■ CRIT shell_command · rm -rf
Watch the sentinel work.
A simulated session, playing itself — exactly what your console shows while your agents run. No interaction required. Nothing here is executed.
THREAT INDEX
“An observer must never break the thing it observes. Siphrix watches everything — and touches nothing.”
Everything a record should be.
Complete
Every decision from every connected surface — browsers, editors, agents on each machine. One timeline, exportable.
Ranked by severity
Critical first, low last. Secret-shaped pastes, destructive commands, data egress — flagged the moment they're written.
Readable
Plain language on the surface, verdicts and reason codes underneath — for the day you need to know exactly what happened.
Loud where you live
One webhook forwards warnings to Slack, PagerDuty or your SIEM. Mute noisy rules; bursts escalate on their own.
Private by construction
Runs on your machine. Metadata only — action, app, verdict, time. Never file contents, never message text.
Enforcing, if you insist
Watching is the default. An opt-in enforcement mode can turn any flag into a hard stop — off until you say otherwise.
Signed at the source
Every machine signs its entries with a key that never leaves it. An auditor verifies the export on their own computer, offline — siphrix verify-evidence — without trusting us or you.
Honest about coverage
siphrix coverage names what this machine runs that nothing records. A named gap beats a clean-looking console that silently omits a surface.
Built for providers
Run security for thirty companies? One Clients screen, health numbers only, worst first. Their entries never cross to you — reading a record takes that client's own sign-in.
Region-pinned, if promised
An account pinned to the EU is served by the EU instance and refused — explicitly, naming both sides — anywhere else. A residency label that moves no data is a lie; this one refuses instead.
Your coding agent, on the record.
Claude Code, Codex and MCP-speaking agents link with one command. Every tool call is evaluated and written down before it runs — the audit trail builds itself while you work.
- Record-only by default — an observer must never break the thing it observes
- A real policy engine underneath: verdicts, reason codes, decision ids
- Source-available — read every line before you trust it; BUSL 1.1, and each version converts to MIT four years after release · fully offline · a JSON log you own
Fair questions, straight answers.
Do I need to be technical?
No. Siphrix senses your surfaces on its own — you just set how closely each one is watched: Dormant, Standard or Vigilant, in plain words. The technical detail exists underneath for those who want it, and stays out of the way for those who don't.
What happens when something risky is spotted?
It's written down instantly and lands in your Warnings, ranked by severity, with the reason in plain language. Forward it to Slack, PagerDuty or a SIEM if you like. The action itself is not stopped — you stay in charge.
Can it actually block things?
Yes — as an explicit opt-in. Enforcement mode turns flags into hard stops, for those who want prevention rather than a record. It ships off, because a sentinel that quietly interferes with your work is not a sentinel you can trust.
Will it slow down or break my tools?
No. The record is written beside your tools, not in front of them. Even if Siphrix itself fails, your workflow continues untouched — that is a design rule, not a promise.
Where does my data go?
Nowhere, unless you say so. The log lives on your machine as metadata only — action, app, verdict, time. The optional cloud console syncs those same safe entries across your devices. Content never leaves.
Couldn't you — or we — just edit the log?
That is the question an audit product must answer or admit it is a diary. Every entry is hash-chained to the one before it, so removing or editing anything breaks every seal after it. And separately: every machine signs its entries with a key that never leaves it — not to us, not to the console. Export an evidence pack and siphrix verify-evidence re-checks every signature on your own computer, offline, with Siphrix switched off. An edited entry fails. An invented entry fails. We could not forge your record if we wanted to, and that is the point.
What's free, and what do you actually charge for?
The licence changed at 2.0.0, so here is the whole truth, in order. Versions 1.8.9 and earlier are MIT. Forever. That is everything already published — the PyPI releases up to 1.8.9, the browser extension 0.8.x, the VS Code extension 0.12.x — and it is irrevocable: nothing we do from here relicenses a byte of it. This answer used to promise the whole product under MIT; that promise still binds every version it was made about, and the repository keeps the old claim on record — marked superseded, never deleted — because an audit product that rewrote its own history would deserve none of your trust.
From 2.0.0, Siphrix is source-available under the Business Source License 1.1. You can still read every line — the engine, the bridges, the console — which is the same reason the evidence bundle verifies offline. Production use requires a commercial license. Write to hello@siphrix.com: a person answers and an invoice follows, not a checkout page. And BUSL is a timed licence, not a permanent one — every version becomes MIT four years after its release.
We're a provider — can we watch all our clients at once?
Yes, with their consent and within a hard boundary. Each client creates a one-time code in their own console; you redeem it and they appear on your Clients screen — health numbers only, worst first. You see how much happened, what is waiting, where the gaps are. You never see their entries, rules or keys: reading a record still takes that client's own sign-in, and either side can end the link at any moment.
Our records must stay in the EU. Can you promise that?
We can refuse, which is stronger than promising. An account pinned to a region is served only by that region's instance — a valid sign-in presented to the wrong region gets an explicit refusal naming both sides, not a quiet redirect. And the pin is one-way: moving later means export, delete, re-enrol, because a label change that moves no data would be a lie.
Put your AI on the record.
Every agent your organisation runs, on one tamper-evident record your auditor can verify — deployed in a day, not a quarter. Tell us what you run; a person answers.
Open your console