Agentmetry

Agentmetry functions as a local-first endpoint sensor specifically designed for coding agents. It provides critical oversight for tools like Claude Code, Cursor, and Codex by: • Recording every tool call made by coding agents • Maintaining a hash-chained trail of activities • Detecting unauthorized changes to tool configurations • Forwarding canonical events to existing SIEM systems • Operating without complex installation requirements This robust system records each tool call directly on the developer's laptop, creating an immutable, verifiable log. It employs hash-chaining to ensure the integrity of the activity trail, allowing third parties to audit agent actions with confidence. A key feature is its ability to detect 'MCP rug pulls' by hashing tool lists and recording when these lists change while the underlying configuration remains constant, offering a critical security layer against stealthy modifications. The system stores hashes, not the actual text of the actions, enhancing privacy and reducing storage overhead. Agentmetry integrates seamlessly with popular Security Information and Event Management (SIEM) platforms such as Splunk, Elastic, Google SecOps, and Microsoft Sentinel. This enables organizations to leverage their existing security infrastructure for monitoring coding agent behavior, streamlining incident response, and ensuring compliance. It's designed to be lightweight and accessible, requiring no installation—users can simply run a demo command to get started. Ideal for engineering and security teams focused on maintaining secure development environments and ensuring the accountable operation of coding agents. It offers transparency into agent activities, helps identify potential misuse or vulnerabilities, and strengthens overall software supply chain security.