{"slug": "agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine", "title": "Agentmetry: an open-source record of what your coding agent did on your machine Category: Show and Tell", "summary": "Agentmetry, an Apache 2.0 open-source recorder published on GitHub by blitzcrieg1, logs every tool call made by coding agents such as Claude Code, Codex and Cursor to a local hash-chained log and flags suspicious call sequences, with nothing leaving the machine unless forwarded. Two of its detections target Hugging Face Hub use: a `huggingface.co` fetch via `curl`, `wget` or `Invoke-WebRequest` followed in the same session by a script execution (`python x.py`, `bash x.sh`, `python -c`) is flagged, as is use of `$HF_TOKEN` or `$HUGGING_FACE_HUB_TOKEN` followed by `hf`, `huggingface-cli`, `aws`, `gcloud` or `kubectl`, which is rated critical. The tool is a record rather than a sandbox and blocks nothing by default, and a standalone `hf download` is not treated as a staged fetch; a demo runs via `uvx agentmetry demo`.", "body_md": "If you let Claude Code, Codex or Cursor run commands for you, there is usually no record afterwards of what they actually ran. Agentmetry is an open-source recorder for that (Apache 2.0). It hooks into the agent, writes every tool call to a local hash-chained log, and flags sequences of calls that look like an attack. Nothing leaves your machine unless you forward it.\n\nTry it with nothing installed:\n\n```\nuvx agentmetry demo\n```\n\nThe demo replays a short session, shows a detection firing, then edits the log and shows `verify` failing.\n\nTwo of the detections involve the Hub, because agents use it like any other download source:\n\n`huggingface.co` with `curl`, `wget` or `Invoke-WebRequest`, and a later command runs a script (` python x.py`, `bash x.sh`, `python -c`), that pair is flagged. GitHub raw files, gists and pastebin are treated the same way. Package managers are not.`$HF_TOKEN` or `$HUGGING_FACE_HUB_TOKEN`, followed in the same session by `hf`, `huggingface-cli`, `aws`, `gcloud` or `kubectl`, is flagged as critical. Neither call is unusual on its own. The order is what matters.\nWhat it does not do: it records what the agent reported through its hooks, so it is a record, not a sandbox, and it does not stop anything by default. `hf download` on its own is not treated as a staged fetch.\n\nThe rules are in the repo under `apps/orchestrator/agentmetry/core/audit/detection/`: [GitHub - blitzcrieg1/agentmetry: Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you already run. · GitHub](https://github.com/blitzcrieg1/agentmetry)\n\nA question for anyone here who runs agents against the Hub: what does an agent do in your workflow that you would want to see afterwards and currently can’t? And if one of these two rules would fire on something you do every day, I’d like to know that too.", "url": "https://wpnews.pro/news/agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine", "canonical_source": "https://discuss.huggingface.co/t/agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine-category-show-and-tell/191787#post_1", "published_at": "2026-11-12 17:37:58+00:00", "updated_at": "2026-11-12 17:53:17.218114+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Agentmetry", "blitzcrieg1", "Claude Code", "Codex", "Cursor", "Hugging Face", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine", "markdown": "https://wpnews.pro/news/agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine.md", "text": "https://wpnews.pro/news/agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine.txt", "jsonld": "https://wpnews.pro/news/agentmetry-an-open-source-record-of-what-your-coding-agent-did-on-your-machine.jsonld"}}