I Built a Flight Recorder for AI Agents (Because “What Did It Do?” Shouldn’t Be a Mystery)

A developer released AGENTBOX, a zero-dependency, fully local flight recorder that wraps any AI agent or command and produces a hash-chained JSONL session file of every tool call, shell command, file operation and URL hit. Each event commits to the previous one via SHA-256, so `agentbox verify` flags any tampering, and all strings are redacted before hashing so secrets are not recoverable from the tape. The tool offers replay scrubbing, one-page session receipts, shareable clips, and passive hook-based recording for Claude Code.

AI agents now run your shell, edit your files, and ship to prod—often with zero humans in the loop. The tooling explosion of 2026 made software agent-native … and produced exactly one new question: "What did my agent actually do while I was away?" AGENTBOX https://github.com/arunsoman/agentbox is the answer. Strap a flight recorder to any command or agent—no SDK, no code changes, no cloud—and get a tamper-evident tape of everything it did: every tool call, every file touched, every URL hit. I recently came across this project and it solves a problem I didn't know I had. Let me break down why it matters and how you can try it in 10 seconds. If you've used Claude Code, Codex CLI, or any autonomous coding agent, you know the drill: you give it a task, it runs for a while, and then something breaks. Maybe it deleted a file, maybe it hit an unexpected API, or maybe it just did something… odd . Traditional logging doesn't cut it. You need a forensic record —a black box that captures everything in a way that can't be quietly edited afterward. That's exactly what AGENTBOX does. AGENTBOX is a zero-dependency, 100% local flight recorder for AI agents . It wraps any command or agent and produces a session file JSONL containing every event: tool calls, shell commands, file operations, URLs hit, even human keystrokes. The tagline says it all: " npm test for your agent's behavior · tamper-evident · 100% local · zero dependencies" agentbox replay opens an interactive scrubber—like security footage for your terminal. ▲ tool call · $ shell · ✎ file op · i human input 00:47.2 , the moment it dropped the table HUMAN lines --headless renders a static frame for CI, GIFs, and GitHub Every event is hash-chained. Each line commits to the previous one: { i, t, type, data, prev, hash } hash = sha256 prev ‖ i ‖ t ‖ type ‖ data Edit one line—even a single character—and agentbox verify pins the exact event: bash $ agentbox verify ✗ hash mismatch at event 7 — event was tampered with or forged That makes the session file evidence, not a log : post-mortems, compliance, "the agent did it / no it didn't" arguments in PRs—settled. Every string written to a session file is scrubbed before it is hashed and appended. The chain commits to the redacted form, so the original secret is not recoverable from the file, the receipt, or a shared clip. Default patterns catch API tokens, cloud keys, auth headers, private keys, and connection strings. You can extend the redaction patterns via AGENTBOX REDACT EXTRA or project-local config. 1. Watch a scripted agent get recorded npx agentbox-cli demo 2. Wrap anything — your agent, a script, any CLI agentbox wrap -- claude "refactor auth.js" agentbox wrap --name eval-run -- python evaluate.py --suite prod 3. Read the tape agentbox list all sessions agentbox receipt newest session, one page agentbox replay scrub the footage agentbox verify tamper check 4. Share a moment, not a dump agentbox clip --from 30 --to 75 → self-contained .clip.html 5. Or skip the wrapper entirely — passive mode agentbox init claude hooks → every claude session, recorded agentbox mcp -- npx -y @modelcontextprotocol/server-everything No install, no config, no accounts. Sessions land in ./.agentbox/sessions/ next to your repo—commit them if you want receipts in git history. Wrapping is for flights you know about in advance. Adapters are for the ones you don't. For Claude Code, you can merge hooks into your settings with a single command: agentbox init claude merges hooks into .claude/settings.json agentbox init claude --local .claude/settings.local.json instead agentbox init claude --remove clean uninstall From the next session on, Claude Code quietly feeds every event to agentbox hook claude . agentbox demo Every session ends with a one-page flight receipt. Here's real output from the demo: ⬢ M A Y D A Y R E C E I P T ┌──────────────────────────────────────────────────┐ │ session demo-deploy │ │ command node examples/fake-agen… │ │ started 2026-09-24 18:40:52 │ │ duration 5.4s │ │ exit code 0 clean landing │ ├──────────────────────────────────────────────────┤ │ tool calls 7 │ │ · bash "git status --s… │ │ · write src/deploy.sh … │ │ · bash "./deploy.sh --… │ │ … +4 more │ │ shell commands 1 │ │ · rm -rf /tmp/old-buil… │ │ files touched 2 · 1 written · 1 edited │ │ · src/deploy.sh wrote │ │ · config.yaml edited │ │ urls hit 1 │ │ output volume 808 B across 17 lines │ │ stderr lines 0 │ │ humans consulted 0 unsupervised flight │ ├──────────────────────────────────────────────────┤ │ events recorded 19 │ │ tamper chain sha256 · intact │ └──────────────────────────────────────────────────┘ uneventful flight. the best kind. Agentic tooling is moving fast, and trust is the bottleneck. Before you let an agent run terraform apply or kubectl delete , you need to know you can audit exactly what happened —and prove it wasn't altered. AGENTBOX fills that gap with a beautiful, minimal approach: It's the kind of tool that should be in every agent operator's toolkit. Head over to the repo and try the demo: 👉 github.com/arunsoman/agentbox https://github.com/arunsoman/agentbox npx agentbox-cli demo If you're running agents in production or just want to know what they're really doing , give it a star and let the author know what you think. Have you used AGENTBOX or a similar auditing tool for your agents? Share your experience in the comments below.