The session scrolls by faster than you can read it. The agent opens ~/.ssh/id_ed25519, writes a small file to /tmp, and makes a request to a domain you don't recognize. Your pulse ticks up. Then you open the logs and find exactly what you'd expect from an afternoon of normal developer activity — a process that ran, a shell that executed, a network call that happened. Task or exfiltration? The observability stack can't say. That is the gap Agentmetry was built for. It's an open-source, Apache-2.0 "flight recorder" for AI coding agents, created by a developer who goes by blitzcrieg1. The pitch is direct: capture every tool call, approval, and denial from Cursor, Claude Code, Codex, and Antigravity, map everything into a MITRE ATT&CK-enriched audit trail, and — only if you want — forward it to the SIEM you already operate. Loki, Elastic, Splunk. No telemetry leaves the machine by default. The project is still in public alpha. It's early, the APIs are expected to change, and the README is upfront about that. But the problem it targets isn't hypothetical.

AI coding agents don't just suggest code anymore. They edit files, run commands, install packages, touch credentials, and — with approval flows in place — act semi-autonomously. A single session can fan out across a repository in minutes. The record it leaves behind, however, is often just a process list and a truncated chat transcript. That's not enough to answer the questions security teams actually ask: What did the agent access? Did a human approve it? Was that curl part of the task, or part of the attack? The mismatch is structural. As the Agentmetry README puts it: "When an autonomous agent runs a tool, most stacks keep nothing you could hand to an incident responder. Logs show a process; they do not show intent, session boundaries, or what the human approved." Traditional SIEMs correlate on two axes: shared entity and shared time. AI agents generate machine-speed, multi-turn conversations that look nothing like human user sessions. One security analyst framed it bluntly: "Enterprise SIEMs, EDRs, and XDRs were built to detect human-initiated attacks. AI agents operate at machine speed across multiple concurrent tasks, obfuscate intent through tool-chaining, and exploit the gap between your identity governance and non-human compute provisioning." That's why the tool's design focuses on patterns rather than single events. As security researchers have pointed out, "AI agents don't behave like attackers. They behave like legitimate systems. They use the same APIs your applications use." The threat lives in the sequence, not the individual action.

Making the Invisible Auditable

Agentmetry observes at the boundary between the agent and the host. It intercepts tool calls through IDE lifecycle hooks for Cursor, Claude Code, Codex, and Antigravity, and it captures Model Context Protocol (MCP) traffic at the wire through a stdio audit proxy. Every event is normalized into a canonical schema, tagged with MITRE ATT&CK context, and hashed with SHA-256 so the trail can't be quietly rewritten. | Capability | What it does | |---|---| | Interception | Captures tool calls through IDE lifecycle hooks and an MCP stdio audit proxy | | Normalization | Converts every event into canonical schema v1.1.0 with MITRE ATT&CK enrichment and SHA-256 argument hashing | | Sequence detection | Correlates behavioral patterns single events can't reveal — credential access followed by egress, guardrail bypass, recon-then-grab | | DLP | Blocks secrets and PII at the hook boundary with a local regex engine, in log or block mode | | SIEM forwarding | Ships events to Loki, Elastic, or Splunk when centralized monitoring is required | The sequence detection piece is the one worth watching. Reading an SSH key is routine. Reading an SSH key and then making an outbound call is a story. Agentmetry's DLP engine can also stop secrets at the hook boundary — before the data leaves the machine — in either log or block mode.

The Local-First Call

Most observability tools are built on a cloud-first reflex: ship everything to a vendor, sort it out there. Agentmetry runs entirely on the operator's machine. The README calls the goal "an immutable, operator-owned audit trail for governed AI agents — capturing tool execution at the IDE lifecycle boundary and the MCP wire, not in a vendor cloud." The reasoning is partly practical. Source code is the crown jewel for most software companies, and streaming it through another cloud service is a non-starter for many security teams. Local-first also changes the cost structure of observability: no per-event ingestion fees, no egress charges for data that never needed to leave the machine. The economics show up in real deployments — San Francisco's city and county government, for example, cut its log data by 70% using Cribl Stream specifically to avoid expanding its SIEM license. The trade-off is worth stating plainly. Agentmetry doesn't eliminate detection cost; it moves it from the license line to the engineering line. An open-source recorder still needs someone to run it, tune its rules, and respond to what it finds. Teams already operating Elastic or Loki will find that burden manageable. Teams expecting a plug-and-play product will not.

Reading the Wire, Not the Marketing

From a technical standpoint, the interesting choice is where Agentmetry watches. It hooks the moment an agent invokes a tool — before that action lands on the host. That's the earliest point where intent becomes visible: the tool name, the arguments, the approval state. The MCP stdio proxy adds a second vantage point at the wire level, so the picture spans both the agent's decision layer and the actual byte stream. The SHA-256 hashing matters for compliance, not just forensics. ISO/IEC 42001:2023, the global AI management system standard, provides a governance framework — but a single-point audit only proves the system was sound at the moment of review. It says nothing about the thousands of runtime tool calls an agent makes afterward. That static-to-runtime gap is exactly what a tamper-evident audit trail is meant to fill.

The Market Got the Memo Before Most Teams Did

Agentmetry is entering a category that's accelerating. According to Mordor Intelligence, the agentic AI monitoring, analytics, and observability market was worth $550 million in 2025 and is projected to reach $2.05 billion by 2030 — a 30.10% compound annual growth rate. The funding flow matches the optimism: Neo raised $100 million in a round led by a16z and Bessemer Venture Partners, Noma Security closed a $100 million Series B, and Runlayer, which focuses on MCP security, picked up an $11 million seed from Khosla Ventures and Felicis. The urgency isn't just about projections. The past year produced a steady drumbeat of incidents that made agent auditing a board-level topic. In July 2026, China's National Vulnerability Database issued a risk advisory covering Claude Code versions 2.1.91 through 2.1.196. The advisory said the tools contained a hidden monitoring mechanism that returned sensitive telemetry to remote servers without user consent. A developer teardown that circulated afterward claimed the mechanism checked whether the system timezone was set to China and compared proxy URLs against hardcoded Chinese domains and AI lab names. Alibaba banned internal use of Claude Code on July 10; other Chinese tech firms told engineers to pull back on external Claude calls. The same month, security researchers reported that Russian-speaking threat actors had weaponized Google's open-source Gemini CLI to operate a botnet. In one documented campaign, the AI agent proactively offered 59 optimization suggestions across more than 200 sessions and migrated command-and-control infrastructure in six minutes. A year earlier, a technique called ShadowLeak showed how easy the abuse can be: attackers instructed an AI agent to encode stolen personal data in Base64 and frame it as a necessary security measure. The reported success rate was 100%. The academic evidence points the same way. A large-scale study posted on arXiv examined 98,380 skills available to coding agents and confirmed 157 malicious ones, containing 632 vulnerabilities across a median of three kill-chain stages. This is not a theoretical risk. Commercial rivals are already moving. Codenotary's AgentMon claims to monitor more than 3 million AI agent interactions per day, with about 7% triggering security, compliance, or operational anomalies. SecureVector, WitnessAI, Vorlon, and NeuralTrust are building in the same direction. Agentmetry's differentiator is its SIEM-native posture: it's designed less for human debugging and more for feeding agent behavior into enterprise security operations.

Quiet Launch, Loud Category

Agentmetry's community reception so far is honest-to-a-fault. The project landed on Hacker News as a Show HN twice — July 15 and August 1, 2026 — and the comments section stayed mostly silent. In an ecosystem where every AI tool launch triggers a 200-comment debate, that quiet is its own kind of signal: the project hasn't yet ignited the conversation its problem space probably deserves. It did get picked up by Python LibHunt and Full-Stack Feed. The LibHunt summary nails the core promise: Agentmetry captures "every tool call, approval, and denial from Cursor, Claude Code, Codex and Antigravity into a MITRE ATT&CK-mapped audit trail." A Chinese tech digest also took notice, describing it as an AI agent debugging and monitoring tool designed specifically for coding agents like Claude Code, built around a local-first architecture. There's a small tell about the author's posture in his previous Hacker News post: "I built an AI crypto trading bot, then proved it had no edge." There's a through-line between that post-mortem and a tool designed to show what agents actually do. Build it. Run it. Show the receipts.

What Comes After Alpha

Agentmetry's roadmap is candid about the stage. The public alpha is intended for "early exploration," and the APIs "may evolve rapidly." No commercial model has been disclosed. For now, it's Apache-2.0 code, documentation, and forwarders for the SIEMs teams already run. The adoption hurdles ahead are organizational, not technical. Gartner projects that only 14.4% of organizations will have AI agents in production with full security or IT approval by 2026 — up from under 5% in 2025. The bottleneck isn't model capability. It's visibility and governance: teams are watching agents execute code on their machines with no shared record of what was done or who approved it. Agentmetry's opportunity is to become that shared record — not by replacing enterprise security stacks, but by making agent activity readable to them. A flight recorder doesn't need to be fancy. It needs to be there, running, before the crash. The agents are moving at machine speed. The logs, so far, aren't.