agentrec is a flight recorder for AI agents. Every file, command and network connection — captured with eBPF and attributed to the exact tool call that caused it. No SDK, no code changes, no trusting what the agent reports.
Prompt firewalls and LLM gateways see the same thing: text going to and from a model. They cannot see the process that read your credentials, opened a socket to the Docker daemon, or piped a script off the internet into a shell.
Approved in a glance. Self-reported by the agent, at the abstraction it chose to show you. This is all an API-layer tool can ever see.
read /root/.aws/credentialsread /root/.npmrcconnect /var/run/docker.sockconnect api.github.com:443The same tool call. The gap between these two panels is exactly what a breach lives in — and exactly what agentrec records.
A single node agent attaches to the kernel with eBPF. The AI agent declares each tool call; the kernel records every syscall it triggers. agentrec joins the two into one attributed record.
A one-line hook — a Claude Code PreToolUse hook or MCP interceptor — announces each tool call before it runs. No rewrite of the agent.
eBPF tracepoints capture the full process tree, every exec with its argv, file access, deletions, and network egress — including the Docker socket.
Every syscall is tied back to the tool call that caused it — through shells, package managers and thread pools — then scored for findings and exported.
Collecting syscalls is well-trodden. Joining them to agent intent is not. agentrec keeps a kernel-side pid → {session, tool_call} map that propagates on every fork, so a tag set on the agent survives exec, nested shells and interpreter chains. Work that outlives the call that started it stays attributed to the right call — because attribution follows process lineage, not wall-clock. The value isn't the events. It's the causality.
Everything an agent touched, in a form a security reviewer can actually read — and an auditor can trust.
A diff-able timeline of every process, file, command and connection — grouped under the tool call that caused it. Replay any session after the fact.
Credential reads, container-runtime sockets, curl | sh, privilege escalation and destructive deletes surface automatically, most-severe first.
Every destination the agent reached, deduplicated and counted — so a quiet exfil to an unfamiliar host stands out from routine package traffic.
Move from record to block. BPF-LSM policy denies a forbidden action at the kernel hook — before the file opens or the socket connects — with a clean error the agent can react to.
Structured JSON and per-event JSONL out of the box, OTLP to your existing stack. Immutable session records built for SOC 2 and internal audit.
One DaemonSet per node. No SDK, no sidecar in the agent, no code changes. Works across vendors — because it reads the kernel, not the agent's own logs.
The agent's own words head each block, so you read intent and action side by side.
Credential reads and runtime-socket access are marked in red and lifted into the findings summary.
An upload that outlives the call that launched it is still filed under the right call — verified against concurrency and ten levels of nesting.
The fear isn't a bad prompt. It's an autonomous process with real credentials and real network access, doing real work with nobody watching. That's Linux — and that's where agentrec lives.
A coding agent on a runner has your registry tokens, cloud keys and push access. When it runs npm install, what did the postinstall scripts actually reach for?
Codespaces, remote workspaces, hosted agents. They need credentials to do useful work — so isolation alone can't tell you what happened inside.
An agent handling tickets, ops or data with tool access is a live process on your infrastructure. You need an unforgeable record of every action it takes.
Prompt firewalls read text. Workload security watches containers, not agent tool calls. Platform audit logs say what the agent claims. agentrec records what the kernel saw — independently.
| Capability | Prompt firewalls / gateways | Runtime / workload security | Platform audit logs | agentrec |
|---|---|---|---|---|
| Sees actual syscalls, not just text | — | ✓ | — | ✓ |
| Attributed to the agent's tool call | partial | — workload only | partial | ✓ to the call |
| Independent of the agent's own report | — | ✓ | — self-reported | ✓ unforgeable |
| Vendor-neutral across agent frameworks | partial | ✓ | — one vendor | ✓ |
| No code changes to the agent | — | ✓ | ✓ | ✓ |
| Built for agent sessions, not pods | — | — | ✓ | ✓ |
Numbers from a 6.8 kernel. A realistic agent session is a few hundred events over several seconds — well below anything a user would feel.
Enterprises are shipping autonomous agents into places that hold real credentials. The category that records and controls what those agents do at the machine level does not yet have an owner.
This lands in security and compliance, not dev tools. Every enterprise rolling out agentic coding has a team writing agent policy with no enforcement and no evidence. Audit is already asking "what did it do" — and the honest answer today is "we don't know."
Start read-only: audit and evidence, easy to approve, zero blast radius. Turn on enforcement once the data is trusted. Then become the control plane for agent authorization — the durable, high-value position.
Point it at a real agent session and show the timeline: every file, command and destination, keyed to intent. Buyers have never seen this and understand it instantly.
The value is attribution to intent, not collection. That requires correct causality across a live process tree — the part that's genuinely hard, and can't be casually cloned from open-source collectors.
Clean, deployment-based pricing. Read-only recording is easy to approve; enforcement and compliance tiers are where the depth lives.
Attributed recording and findings for CI runners and dev environments.
Everything in Recorder, plus kernel-enforced policy for production agents.
Immutable evidence and audit workflows for regulated teams at scale.
We're onboarding a small group of teams running agents in CI and production. Bring one real agent workload; we'll show you a recording of it within a week.
Linux · eBPF · no code changes · runs in your environment