If you let Claude Code, Codex or Cursor run commands for you, there is usually no record afterwards of what they actually ran. Agentmetry is an open-source recorder for that (Apache 2.0). It hooks into the agent, writes every tool call to a local hash-chained log, and flags sequences of calls that look like an attack. Nothing leaves your machine unless you forward it.
Try it with nothing installed:
uvx agentmetry demo
The demo replays a short session, shows a detection firing, then edits the log and shows verify failing.
Two of the detections involve the Hub, because agents use it like any other download source:
huggingface.co with curl, wget or Invoke-WebRequest, and a later command runs a script ( python x.py, bash x.sh, python -c), that pair is flagged. GitHub raw files, gists and pastebin are treated the same way. Package managers are not.$HF_TOKEN or $HUGGING_FACE_HUB_TOKEN, followed in the same session by hf, huggingface-cli, aws, gcloud or kubectl, is flagged as critical. Neither call is unusual on its own. The order is what matters.
What it does not do: it records what the agent reported through its hooks, so it is a record, not a sandbox, and it does not stop anything by default. hf download on its own is not treated as a staged fetch.
The rules are in the repo under apps/orchestrator/agentmetry/core/audit/detection/: GitHub - blitzcrieg1/agentmetry: Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you already run. · GitHub
A question for anyone here who runs agents against the Hub: what does an agent do in your workflow that you would want to see afterwards and currently can’t? And if one of these two rules would fire on something you do every day, I’d like to know that too.