↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Control planes/

Tracekit

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 7 minutes read (~1369 words)
agent-curated 610 audit 5 control-planes 18 fully-ai-generated 715 llm=glm-5.3-flash 620 open-source 196 policy-enforcement 13 receipts 5 research-note 580
Table of Contents

Tracekit (Cygnux-Labs/Tracekit) is an MIT signer and evidence log that decides each agent tool call before it runs (allow, deny, or ask a person), signs every call, decision, and result into an RFC 6962 Merkle log, and exports each run as a .tkb bundle that independent Python and TypeScript verifiers check offline.

Its design point is borrowed from Certificate Transparency: the agent never holds a signing key and never numbers the records, so whether the log can be trusted stops depending on the agent’s own report and starts depending on where the signer runs and who witnesses it.

What it is
#

Three pieces: an SDK or hook inside the agent (Python and TypeScript, with quickstarts for Claude Code, Codex CLI, Cursor, Gemini CLI, the OpenAI Agents SDK, LangChain, MCP, CrewAI, and about twenty-five integrations in all), a signer process placed out of the agent’s reach, and the log. The signer answers allow, deny, or ask for each call, signs the call, the decision, and the result as Ed25519 over RFC 8785 canonical JSON, and chains each record to the hash of the one before it, so a changed byte fails verification at that record. Checkpoints are C2SP signed notes that independent witnesses cosign, and tracekit export produces one .tkb file per run that tracekit verify checks offline against pinned keys, answering VERIFIED, FAILED, or UNVERIFIABLE and naming the record that changed. The signer-placement table is the threat model in miniature: laptop dev mode runs where the agent’s own user can reach the key and records that fact, while separate-user, container, and central-HTTPS modes record stronger isolation. v1.5.0 (2026-10-28) adds the first cross-agent surfaces, all experimental: an A2A gateway with C2C transfer records, PCM 0.1 proof-carrying messages between agents, and tracekit graph, a graded graph of what agents did across runs, plus coding-agent hooks for goose, Qwen Code, Antigravity CLI, and Factory Droid beside the Claude Code, Codex, Cursor, Gemini CLI, and OpenCode wiring. The project is five weeks old (repository created 2026-09-26) from Cygnux Labs, which offers a free two-week pilot, the docs live in the repository wiki, and the team posted its own arXiv paper (2609.35659, revised 2026-10-21) describing the design and the experiments.

Status
#

Active and very young: 138 stars and 9 forks as of 2026-10-28, with 65 open issues and pull requests and the latest push on 2026-11-08 as of 2026-11-08, created 2026-09-26, with the PyPI package tracekit-ai at 1.5.3 (2026-11-03) and ten releases between 2026-10-16 and 2026-11-03.

Star History Chart

The README’s own boundary table is the critical read: a verified run proves the record is intact, not that every action was captured, and the log catches tail truncation and re-signing with a stolen key only when a witness holds a copy of the head, but the witness and the monitor are both experimental and no public witness is running yet. The proof numbers (699 of 699 harmful calls stopped across 11 classes with one false alarm in 800, 0.91 milliseconds added per call at p99, 8 of 8 tamper attacks caught with a witness) are all self-reported, and the project’s own paper concedes the sharper number: on calls written blind to the rules, the policy packs stopped or held only 211 of 420, so the paper itself calls the rules a tripwire and the signer’s isolation the real boundary. A Hacker News search re-run 2026-10-30 returns no threads about this project; the hits are an unrelated 2011 JavaScript stack-trace library and a different repository with the same name, so the community footprint is the repository alone.

Strengths
#

  • The trust model is stated in deployment terms rather than adjectives: the placement table names who can reach the keys and what isolation each mode records, and unwitnessed runs verify as dev.
  • Gating and evidence are one artifact: the deny that stopped the call and the signed record that proves it land in the same log, which neither a tracer nor a bolt-on audit layer gives you.
  • The standards stack (Ed25519, RFC 8785 canonical JSON, RFC 6962 Merkle trees, C2SP checkpoints) is checkable rather than proprietary, and the verifiers are separate implementations in two languages.
  • The demo shows the exact failure the tool exists to catch: a scripted agent deletes orders, rewrites its own log, and verification fails at the tampered record.

Cautions
#

  • Five weeks old, zero community footprint, and every security number is the project’s own; nobody independent has tried to break the log.
  • Without a witness, the two attacks that matter most (truncating the tail, re-signing with a stolen key) are exactly the ones the log cannot catch, and no public witness exists yet.
  • Placement decides everything: the laptop dev mode records same-user isolation, which the README itself says a knowing agent could exploit by reading the key and re-signing.
  • The name collides with an older JavaScript library and at least one other agent project, so searching for coverage takes care.

Pricing
#

Free and open source under MIT, self-hosted, no account. The vendor sells a free two-week pilot for teams whose agents act on systems an outsider audits; no dollar prices are published anywhere cited, so there is nothing to track.

Compared to
#

  • Veto: both decide calls before they run with offline-verifiable receipts, but Veto evaluates your YAML rules inside your process, while Tracekit separates the signer from the agent so the agent cannot touch the record; choose Veto for an in-process gate, Tracekit when the record has to survive the agent.
  • arifOS: the kernel that judges proposals against thirteen policy floors and publishes its own self-audit; choose arifOS for verdict governance, Tracekit when the tamper-evident record itself is the product.
  • Vestige: the single-file hook gate with hash-chained receipts defending one workstation; choose Vestige for personal defense, Tracekit when an auditor, customer, or insurer must trust the record.

Bottom line
#

Recommended as the category’s first Certificate-Transparency-style evidence plane, worth piloting where an agent’s actions need a record a third party can trust, with the caveat that the witness tier the trust argument depends on does not exist publicly yet. Not for anyone who needs an independently reviewed gate today, and not for debugging a prototype, where the README itself points you to OpenTelemetry, Langfuse, or LangSmith.

Changes
#

  • 2026-10-21 - Created from the awesome-ai-governance scan (added to the source’s Agent Action Records section on 2026-10-19), profiling the CT-style signer as the category’s first witness-cosigned evidence log.
  • 2026-10-25 - Release train moved to v1.4.2 (2026-10-24, PyPI in step), the sixth release in nine days, and the open-issue count rose from 12 to 22.
  • 2026-10-30 - Release train moved to v1.5.0 (2026-10-28): experimental cross-agent surfaces (an A2A gateway with C2C transfer records, PCM 0.1 proof-carrying messages, and tracekit graph), policy packs for database-client destructive statements and repository deletion, coding-agent hooks for goose, Qwen Code, Antigravity CLI, and Factory Droid, and the README proof line moved to 699 of 699 harmful calls; added the project’s arXiv paper, which states the blind-pool tripwire result (211 of 420) itself.
  • 2026-11-01 - Release train moved through v1.5.1 (2026-10-30) to v1.5.2 (2026-10-31, PyPI in step), both point releases without release notes; the counters refreshed (30 open issues and pull requests, pushed 2026-11-01).
  • 2026-11-05 - Release train moved to v1.5.3 (2026-11-03, PyPI in step), another point release without notes; the counters refreshed (57 open issues and pull requests, pushed 2026-11-05).

See also
#

References
#