Agentmetry: an open-source record of what your coding agent did on your machine Category: Show and Tell

Agentmetry, an Apache 2.0 open-source recorder published on GitHub by blitzcrieg1, logs every tool call made by coding agents such as Claude Code, Codex and Cursor to a local hash-chained log and flags suspicious call sequences, with nothing leaving the machine unless forwarded. Two of its detections target Hugging Face Hub use: a `huggingface.co` fetch via `curl`, `wget` or `Invoke-WebRequest` followed in the same session by a script execution (`python x.py`, `bash x.sh`, `python -c`) is flagged, as is use of `$HF_TOKEN` or `$HUGGING_FACE_HUB_TOKEN` followed by `hf`, `huggingface-cli`, `aws`, `gcloud` or `kubectl`, which is rated critical. The tool is a record rather than a sandbox and blocks nothing by default, and a standalone `hf download` is not treated as a staged fetch; a demo runs via `uvx agentmetry demo`.

If you let Claude Code, Codex or Cursor run commands for you, there is usually no record afterwards of what they actually ran. Agentmetry is an open-source recorder for that Apache 2.0 . It hooks into the agent, writes every tool call to a local hash-chained log, and flags sequences of calls that look like an attack. Nothing leaves your machine unless you forward it. Try it with nothing installed: uvx agentmetry demo The demo replays a short session, shows a detection firing, then edits the log and shows verify failing. Two of the detections involve the Hub, because agents use it like any other download source: huggingface.co with curl , wget or Invoke-WebRequest , and a later command runs a script python x.py , bash x.sh , python -c , that pair is flagged. GitHub raw files, gists and pastebin are treated the same way. Package managers are not. $HF TOKEN or $HUGGING FACE HUB TOKEN , followed in the same session by hf , huggingface-cli , aws , gcloud or kubectl , is flagged as critical. Neither call is unusual on its own. The order is what matters. What it does not do: it records what the agent reported through its hooks, so it is a record, not a sandbox, and it does not stop anything by default. hf download on its own is not treated as a staged fetch. The rules are in the repo under apps/orchestrator/agentmetry/core/audit/detection/ : GitHub - blitzcrieg1/agentmetry: Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you already run. · GitHub https://github.com/blitzcrieg1/agentmetry A question for anyone here who runs agents against the Hub: what does an agent do in your workflow that you would want to see afterwards and currently can’t? And if one of these two rules would fire on something you do every day, I’d like to know that too.