Cygnux-Labs/Tracekit

What it solves

AI agents can be difficult to audit because they can modify their own logs to hide unauthorized actions or mistakes. This project provides a way to ensure that an agent's activity record is tamper-evident, allowing you to verify exactly what an agent did, whether it was allowed, and if the record itself has been altered.

How it works

Tracekit acts as a "flight recorder" for AI agents. It intercepts tool calls before they run, checks them against defined policies, and signs each decision into an append-only hash chain. This creates a cryptographically verifiable file (.tkb) for every run. Because the records are signed and chained, any attempt to edit, delete, or reorder the log after the fact will cause verification to fail.

Who it’s for

It is designed for developers and operators who need to maintain security and accountability for AI agents. It is particularly useful for those who need to prove that an agent followed specific rules, prevent unauthorized tool usage, or audit agent behavior in sensitive environments.

Highlights

• Tamper-evident logging: Uses a hash chain to ensure logs cannot be edited without detection.
• Pre-execution control: Gates tool calls before they run, allowing you to allow, deny, or hold them for human approval.
• Offline verification: Provides a simple command-line tool to verify the integrity of run logs without needing an active internet connection.
• Broad compatibility: Works with many popular agent frameworks and SDKs, including LangChain, LangGraph, CrewAI, and others.
• Minimal overhead: Adds less than 1ms of latency per tool call.