Sentinel-class monitor · for AI agents
Proof of what your AI actually did.
Your agents write files, run commands and reach the network all day. Siphrix records every action from outside the agent — across your terminal, your editor and your browser, on one account — into a chain where removing a single entry breaks every hash after it. It never blocks, so it installs in a day.
Copilot · coding agents
Observability shows you a claim. Siphrix gives you evidence.
Tracing tools ask the agent to report on itself. When an agent is compromised — prompt injection, a hijacked tool call, or simply a bug — the trace describing its behaviour is written by the very code that misbehaved. A self-reported trace is a claim. Siphrix records from outside the agent, where the action is about to happen.
Recorded from outside
Siphrix hooks the agent's harness, so the record never depends on the agent being honest, correct or uncompromised. It sees the action — not the agent's account of it.
A chain, not a log
Every entry carries a SHA-256 over its own fields and the hash before it. Remove one entry and every hash after it stops matching. One click re-walks the chain and says so.
Proof someone else can check
Send an auditor a signed, expiring link. They open it with no account and see the attestation — never your files, never your commands. Revoke every link instantly.
One account, every surface
Terminal, VS Code and browser report into the same record. Coding agents, ChatGPT, Claude and Gemini — one place that knows what all of them did.
The auditor's language
The report names the controls it serves: ISO/IEC 42001 A.6.2.8 — recording of event logs — plus A.6.2.6 and SOC 2 CC7.2. Evidence you can file, not a screenshot.
It never blocks
An observer must not break the thing it observes. Nothing is stopped by default — which is why Siphrix goes in during a sprint, not a procurement cycle.
Your AI already acts in your name. Nobody is watching.
Every tool you connect can touch files, reach the internet and move money. Siphrix is the page you check afterwards — and the alarm that fires before you have to.
It deletes files
One misread instruction and a folder is gone — and without a record, you can't say which agent did it, or when, or why.
■ SEVERITY: CRITICALIt leaks data
A pasted secret, an uploaded document, a message to the wrong place. Siphrix knows the shape of a leak and writes the warning instantly.
▲ SEVERITY: HIGHIt spends money
Payments, subscriptions, purchases — agents can do all of it. Every attempt becomes an entry; the dangerous ones rise to the top.
■ SEVERITY: CRITICALConnect once. The record writes itself.
Link
One click for browsers and editors, one line for coding agents. Siphrix runs beside your tools — never in front of them.
$ siphrix agent-setup # linked.
Record
Files touched, commands run, sites reached, data shared — each becomes one clean, private entry. Metadata only. Never content.
✓ 09:42 http_request · recorded
Alert
Anything dangerous-looking is flagged by severity, with the reason in plain language — the moment it happens.
■ CRIT shell_command · rm -rf
Watch the sentinel work.
A simulated session, playing itself — exactly what your console shows while your agents run. No interaction required. Nothing here is executed.
THREAT INDEX
“An observer must never break the thing it observes. Siphrix watches everything — and touches nothing.”
Everything a record should be.
Complete
Every decision from every connected surface — browsers, editors, agents on each machine. One timeline, exportable.
Ranked by severity
Critical first, low last. Secret-shaped pastes, destructive commands, data egress — flagged the moment they're written.
Readable
Plain language on the surface, verdicts and reason codes underneath — for the day you need to know exactly what happened.
Loud where you live
One webhook forwards warnings to Slack, PagerDuty or your SIEM. Mute noisy rules; bursts escalate on their own.
Private by construction
Runs on your machine. Metadata only — action, app, verdict, time. Never file contents, never message text.
Enforcing, if you insist
Watching is the default. An opt-in enforcement mode can turn any flag into a hard stop — off until you say otherwise.
Signed at the source
Every machine signs its entries with a key that never leaves it. An auditor verifies the export on their own computer, offline — siphrix verify-evidence — without trusting us or you.
Honest about coverage
siphrix coverage names what this machine runs that nothing records. A named gap beats a clean-looking console that silently omits a surface.
Built for providers
Run security for thirty companies? One Clients screen, health numbers only, worst first. Their entries never cross to you — reading a record takes that client's own sign-in.
Region-pinned, if promised
An account pinned to the EU is served by the EU instance and refused — explicitly, naming both sides — anywhere else. A residency label that moves no data is a lie; this one refuses instead.
Your coding agent, on the record.
Claude Code, Codex and MCP-speaking agents link with one command. Every tool call is evaluated and written down before it runs — the audit trail builds itself while you work.
- Record-only by default — an observer must never break the thing it observes
- A real policy engine underneath: verdicts, reason codes, decision ids
- MIT-licensed — all of it, self-host free forever · fully offline · a JSON log you own
Fair questions, straight answers.
Do I need to be technical?
No. Siphrix senses your surfaces on its own — you just set how closely each one is watched: Dormant, Standard or Vigilant, in plain words. The technical detail exists underneath for those who want it, and stays out of the way for those who don't.
What happens when something risky is spotted?
It's written down instantly and lands in your Warnings, ranked by severity, with the reason in plain language. Forward it to Slack, PagerDuty or a SIEM if you like. The action itself is not stopped — you stay in charge.
Can it actually block things?
Yes — as an explicit opt-in. Enforcement mode turns flags into hard stops, for those who want prevention rather than a record. It ships off, because a sentinel that quietly interferes with your work is not a sentinel you can trust.
Will it slow down or break my tools?
No. The record is written beside your tools, not in front of them. Even if Siphrix itself fails, your workflow continues untouched — that is a design rule, not a promise.
Where does my data go?
Nowhere, unless you say so. The log lives on your machine as metadata only — action, app, verdict, time. The optional cloud console syncs those same safe entries across your devices. Content never leaves.
Couldn't you — or we — just edit the log?
That is the question an audit product must answer or admit it is a diary. Every entry is hash-chained to the one before it, so removing or editing anything breaks every seal after it. And separately: every machine signs its entries with a key that never leaves it — not to us, not to the console. Export an evidence pack and siphrix verify-evidence re-checks every signature on your own computer, offline, with Siphrix switched off. An edited entry fails. An invented entry fails. We could not forge your record if we wanted to, and that is the point.
What's free, and what do you actually charge for?
The code is free. All of it, MIT licensed — the engine, the bridges, and the console. pip install siphrix gives you the whole product on your own machine, forever, with no seat count and no phone-home. There is no crippled edition and no feature held back behind a flag; you can read the source to confirm that, which is the same reason the evidence bundle verifies offline.
What we charge for is running it for you — the hosted service at siphrix.com: uptime, backups, upgrades, holding the record, a person to answer when something is wrong, and the operated side of data residency and SSO. Plans price that service. They are limits on a hosted tenancy, not locks on the software: a self-hoster is bound by none of them, and there is no mechanism in the code that could enforce one off our servers.
We're a provider — can we watch all our clients at once?
Yes, with their consent and within a hard boundary. Each client creates a one-time code in their own console; you redeem it and they appear on your Clients screen — health numbers only, worst first. You see how much happened, what is waiting, where the gaps are. You never see their entries, rules or keys: reading a record still takes that client's own sign-in, and either side can end the link at any moment.
Our records must stay in the EU. Can you promise that?
We can refuse, which is stronger than promising. An account pinned to a region is served only by that region's instance — a valid sign-in presented to the wrong region gets an explicit refusal naming both sides, not a quiet redirect. And the pin is one-way: moving later means export, delete, re-enrol, because a label change that moves no data would be a lie.
Initialize the record.
One minute from now, everything your AI does can be on the page.
Install — one command Open your console