agentmetry 0.4.0__tar.gz

agentmetry-0.4.0/.dockerignore

@@ -0,0 +1,5 @@
+.venv
+__pycache__
+*.pyc
+data
+.git

agentmetry-0.4.0/.env.agentmetry-demo

@@ -0,0 +1,29 @@
+# Agentmetry — zero-cloud dogfood profile
+# Copy to apps/orchestrator/.env for audit-only runs (no Gemini, no Qdrant).
+#
+#   copy apps\orchestrator\.env.agentmetry-demo apps\orchestrator\.env
+#   scripts\agentmetry.bat start
+#
+# Generates real tool_called + approval_* events via mock LLM. Draft text is
+# placeholder (mock-dry-run) — fine for JSONL/replay verification, not for Loom.
+# Switch to Gemini or Ollama for the Loom take — see docs/agentmetry-dependency-audit.md Profile B.
+
+# --- audit layer (the product) ---
+AGENTMETRY_OPERATOR_ID=home-lab
+AGENTMETRY_AUDIT_EXPORT_ENABLED=1
+AGENTMETRY_AUDIT_SINK=file
+# Log shell commands from Tier B hooks (Cursor/Claude/Codex/Antigravity) in JSONL + dashboard
+AGENTMETRY_AUDIT_LOG_COMMANDS=1
+
+# --- runtime, no cloud LLM ---
+AGENTMETRY_LLM_PROVIDER=mock
+AGENTMETRY_ALLOW_MOCK=1
+AGENTMETRY_VAULT_PATH=../../vault
+
+# Faster boot for audit-only (no semantic index)
+AGENTMETRY_STARTUP_VAULT_INDEX=false
+
+# Not required for audit dogfood — leave unset / empty:
+# GEMINI_API_KEY=
+# AGENTMETRY_QDRANT_URL=
+# AGENTMETRY_USE_POSTGRES=false  (default)

agentmetry-0.4.0/.env.example

@@ -0,0 +1,20 @@
+# Agentmetry orchestrator — copy to .env and adjust
+# cp apps/orchestrator/.env.example apps/orchestrator/.env
+# Never commit .env — it is gitignored
+
+# Demo MCP vault path (relative to this directory)
+AGENTMETRY_VAULT_PATH=../../vault
+
+AGENTMETRY_OPERATOR_ID=local
+AGENTMETRY_FLEET_ID=
+AGENTMETRY_API_KEY=
+
+# Hook boundary — log | block | disable
+AGENTMETRY_TOOL_POLICY_MODE=log
+AGENTMETRY_DLP_MODE=log
+
+# Audit export (JSONL + SQLite index)
+AGENTMETRY_AUDIT_EXPORT_ENABLED=1
+AGENTMETRY_AUDIT_SINK=file
+
+# More tuning: see repo root .env.example and docs/agentmetry-dogfood-checklist.md

agentmetry-0.4.0/.gitignore

@@ -0,0 +1,98 @@
+# Dependencies
+node_modules/
+.pnp
+.pnp.js
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+.venv/
+venv/
+*.egg-info/
+dist/
+build/
+
+# Next.js
+apps/dashboard/.next/
+apps/dashboard/out/
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# Vault runtime artifacts (agent-generated)
+vault/20-Active-Loops/
+vault/30-Archive/
+vault/.obsidian/
+vault/.system/run-log.md
+vault/.system/Approvals-Digest.md
+
+# IDE
+.idea/
+.vscode/
+*.swp
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Docker volumes
+data/
+
+# Logs
+*.log
+
+# Tier B — machine-local hook wrappers (install scripts regenerate)
+scripts/agentmetry_*_hook.cmd
+
+# Local driver toggles (never commit enabled/disabled state)
+vault/.system/drivers.json
+vault/.system/feedback/
+
+# Backups
+backups/
+
+# Dashboard scratch / scratchpad (never commit)
+apps/dashboard/scratch/
+
+# Next.js/TS incremental build artifact
+*.tsbuildinfo
+
+# Local-only scratch directories (never part of the published repo):
+#   apps/landing/   an unused Vite scaffold (88M of node_modules)
+# Ignored so a stray `git add -A` cannot commit them.
+/apps/landing/
+
+# A stale duplicate clone of this repo used to sit at /agentmetry/, and the rule
+# blocking it was `/agentmetry/`. That rule had to go when the Python package was
+# renamed to `agentmetry`.
+#
+# Git anchors a leading slash to the repository root, so `/agentmetry/` never
+# matched apps/orchestrator/agentmetry/ and `git ls-files` listed all 72 files
+# happily. Hatchling anchors it to the *project* root instead, which is
+# apps/orchestrator, so it excluded the entire package and built a wheel
+# containing nothing but dist-info. A published package that installs no code is
+# the worst possible first release, and nothing in the build said a word.
+#
+# Only a nested clone has a .git directory, and our package never will, so this
+# blocks the thing that was actually the problem without any anchoring ambiguity.
+/agentmetry/.git/
+
+# Local dev launch config (absolute machine paths)
+.claude/launch.json
+
+# Internal review prompts and audit reports. These name pilot pricing, kill
+# gates, and the private repo contents; they belong in agentmetry-notes.
+#
+# The "review" patterns were already here and still let `audit-prompt.md` and
+# `audit-2026-08.md` through, because the rule matched the word we happened to
+# use last time rather than the kind of document. An audit of a security tool
+# is the worst thing to publish by accident: it is an evasion writeup with the
+# author's name on it.
+docs/*review*prompt*.md
+docs/*-review-*.md
+docs/*audit*prompt*.md
+docs/audit-*.md
+docs/*-audit-*.md

agentmetry-0.4.0/Dockerfile

@@ -0,0 +1,18 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY pyproject.toml ./
+COPY . .
+
+RUN pip install --no-cache-dir -e .
+
+RUN mkdir -p /app/data
+
+EXPOSE 8000
+
+CMD ["uvicorn", "api.main:app", "--host", "0.0.0.0", "--port", "8000"]

agentmetry-0.4.0/PKG-INFO

@@ -0,0 +1,86 @@
+Metadata-Version: 2.4
+Name: agentmetry
+Version: 0.4.0
+Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
+Project-URL: Homepage, https://agentmetry.ai
+Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
+Project-URL: Issues, https://github.com/blitzcrieg1/agentmetry/issues
+Project-URL: Changelog, https://github.com/blitzcrieg1/agentmetry/blob/master/CHANGELOG.md
+Author: Ioannis L.
+License: Apache-2.0
+Keywords: agentic-ai,ai-agents,ai-security,audit-log,claude-code,cursor,devsecops,dlp,local-first,mitre-attack,siem
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Logging
+Classifier: Topic :: System :: Monitoring
+Requires-Python: >=3.11
+Requires-Dist: aiosqlite>=0.20.0
+Requires-Dist: fastapi>=0.115.0
+Requires-Dist: httpx>=0.28.0
+Requires-Dist: mcp>=1.2
+Requires-Dist: pydantic-settings>=2.6.0
+Requires-Dist: pydantic>=2.9.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: sqlalchemy>=2.0.0
+Requires-Dist: tzdata; sys_platform == 'win32'
+Requires-Dist: uvicorn[standard]>=0.32.0
+Requires-Dist: websockets>=14.0
+Provides-Extra: dev
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff==0.16.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# Agentmetry
+
+A local-first flight recorder for AI coding agents.
+
+Agentmetry hooks the tool lifecycle of Claude Code, Cursor, Codex and Antigravity,
+writes every tool call, approval and denial to a hash-chained JSONL trail on your
+machine, and runs sequence detection over the session. A credential read followed
+by network egress becomes one finding rather than two unremarkable log lines.
+
+Everything runs locally. There are no cloud calls and no telemetry. Forwarding to
+Elastic ECS, Splunk HEC or a webhook exists and is off unless you configure it.
+
+```bash
+pip install agentmetry
+agentmetry doctor
+```
+
+## Check the detection claims yourself
+
+The corpus ships inside the package, so this works from a clean install:
+
+```bash
+agentmetry benchmark
+```
+
+It replays recorded sessions through the real rule engine and exits non-zero on
+any missed rule or any false positive. The benign half is the number that
+matters: any tool can fire on an attack, and a feed that cries wolf gets muted.
+
+## What it does not do
+
+- **It is not a CASB.** It records the agents you wire in. An unmanaged browser
+  assistant is invisible to it.
+- **It is a recorder, not a sandbox.** The only enforcement path is pre-execution
+  DLP blocking in the hook.
+- **The DLP is regex, not ML.** A starting pack you extend in YAML.
+- **It is a public alpha.** Integration surfaces may still change.
+
+Full documentation, the event schema, and the SIEM integration guides are in the
+repository.
+
+- Source and issues: https://github.com/blitzcrieg1/agentmetry
+- Website: https://agentmetry.ai
+
+Apache-2.0.

agentmetry-0.4.0/README.md

@@ -0,0 +1,45 @@
+# Agentmetry
+
+A local-first flight recorder for AI coding agents.
+
+Agentmetry hooks the tool lifecycle of Claude Code, Cursor, Codex and Antigravity,
+writes every tool call, approval and denial to a hash-chained JSONL trail on your
+machine, and runs sequence detection over the session. A credential read followed
+by network egress becomes one finding rather than two unremarkable log lines.
+
+Everything runs locally. There are no cloud calls and no telemetry. Forwarding to
+Elastic ECS, Splunk HEC or a webhook exists and is off unless you configure it.
+
+```bash
+pip install agentmetry
+agentmetry doctor
+```
+
+## Check the detection claims yourself
+
+The corpus ships inside the package, so this works from a clean install:
+
+```bash
+agentmetry benchmark
+```
+
+It replays recorded sessions through the real rule engine and exits non-zero on
+any missed rule or any false positive. The benign half is the number that
+matters: any tool can fire on an attack, and a feed that cries wolf gets muted.
+
+## What it does not do
+
+- **It is not a CASB.** It records the agents you wire in. An unmanaged browser
+  assistant is invisible to it.
+- **It is a recorder, not a sandbox.** The only enforcement path is pre-execution
+  DLP blocking in the hook.
+- **The DLP is regex, not ML.** A starting pack you extend in YAML.
+- **It is a public alpha.** Integration surfaces may still change.
+
+Full documentation, the event schema, and the SIEM integration guides are in the
+repository.
+
+- Source and issues: https://github.com/blitzcrieg1/agentmetry
+- Website: https://agentmetry.ai
+
+Apache-2.0.

agentmetry-0.4.0/agentmetry/__init__.py

@@ -0,0 +1,12 @@
+"""Agentmetry: a local-first flight recorder for AI coding agents.
+
+Everything lives under this one top-level package on purpose. The orchestrator
+used to ship `core`, `api` and `cli` as top-level names, which is harmless for an
+editable install inside this repo and antisocial once published: three of the
+most generic importable names in Python, dropped into someone else's
+site-packages, where they collide with whatever else claims them.
+"""
+
+from agentmetry.core.version import __version__
+
+__all__ = ["__version__"]

agentmetry-0.4.0/agentmetry/api/main.py

@@ -0,0 +1,232 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+from contextlib import asynccontextmanager
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
+from fastapi import FastAPI, Query, WebSocket, WebSocketDisconnect
+from fastapi.middleware.cors import CORSMiddleware
+
+from agentmetry.api.routes.audit import router as audit_router
+from agentmetry.api.websocket import ws_manager
+from agentmetry.api.ws_bridge import ws_event_bridge
+from agentmetry.core.auth import verify_ws_token
+from agentmetry.core.bus.audit_exporter import audit_exporter
+from agentmetry.core.bus.bridges import outbox_persister
+from agentmetry.core.bus.bus import bus
+from agentmetry.core.bus.outbox import get_outbox
+from agentmetry.core.config import settings
+from agentmetry.core.extensions import load_extensions
+from agentmetry.core.health import get_system_health
+from agentmetry.core.version import __version__
+
+logger = logging.getLogger(__name__)
+
+_LOG_DIR = Path(__file__).resolve().parents[2] / "data" / "logs"
+
+
+def _setup_logging() -> None:
+    """Persist app logs to disk so they survive a closed terminal."""
+    root = logging.getLogger()
+    if any(isinstance(h, RotatingFileHandler) for h in root.handlers):
+        return
+    _LOG_DIR.mkdir(parents=True, exist_ok=True)
+    formatter = logging.Formatter("%(asctime)s %(levelname)s %(name)s: %(message)s")
+
+    file_handler = RotatingFileHandler(
+        _LOG_DIR / "orchestrator.log",
+        maxBytes=5_000_000,
+        backupCount=3,
+        encoding="utf-8",
+    )
+    file_handler.setFormatter(formatter)
+    root.addHandler(file_handler)
+
+    console = logging.StreamHandler()
+    console.setFormatter(formatter)
+    root.addHandler(console)
+
+    if root.level in (logging.NOTSET, logging.WARNING):
+        root.setLevel(logging.INFO)
+
+
+_setup_logging()
+
+
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    from agentmetry.core.audit.migrate import backfill_db_from_jsonl
+
+    # Backfill SQLite from the existing JSONL trail. A broken or locked audit DB
+    # must degrade the dashboard, never stop the daemon from booting: the
+    # recorder's job is to keep recording.
+    try:
+        await asyncio.to_thread(backfill_db_from_jsonl)
+    except Exception:
+        logger.exception("Audit trail backfill failed; continuing without it")
+
+    # Replay events the hooks captured while this process was down. Same
+    # non-fatal contract as the backfill: a broken spool must not stop the
+    # recorder from booting.
+    #
+    # Deliberately not awaited. Draining a few thousand spooled events takes
+    # minutes, and awaiting it here holds the ingest port closed for the whole
+    # time — so every hook that fires during the drain is refused and spooled,
+    # which makes the next drain larger. The recorder has to be reachable first
+    # and catch up second.
+    from agentmetry.core.audit.spool import drain_forever, drain_spool
+
+    async def _boot_drain() -> None:
+        try:
+            await drain_spool()
+        except Exception:
+            logger.exception("Hook spool drain failed; continuing without it")
+
+    # Bring the triage index back in step with the trail. `reconcile_at_boot`
+    # declines rather than rebuilding when the trail cannot account for a
+    # decision the index already holds — a pruned or repointed trail must not
+    # silently erase the corrective-action record.
+    from agentmetry.core.audit.detection.disposition import reconcile_at_boot
+
+    try:
+        await asyncio.to_thread(reconcile_at_boot)
+    except Exception:
+        logger.exception("Disposition reconcile failed; continuing without it")
+
+    # Event bus first: everything downstream publishes onto it.
+    bus.set_initial_seq(get_outbox().max_seq())
+    bridge_tasks = [
+        asyncio.create_task(ws_event_bridge(), name="ws-bridge"),
+        asyncio.create_task(outbox_persister(), name="outbox-persister"),
+        asyncio.create_task(audit_exporter(), name="audit-exporter"),
+        asyncio.create_task(_boot_drain(), name="spool-boot-drain"),
+        # Keep draining for as long as we run. A boot-only drain leaves a
+        # backlog growing unnoticed whenever ingest is unreachable while the
+        # process itself stays up.
+        asyncio.create_task(drain_forever(), name="spool-drain"),
+    ]
+
+    # Drivers mount in the background: a slow npx download must not delay boot.
+    from agentmetry.core.drivers.host import get_mcp_host
+
+    mount_task = asyncio.create_task(get_mcp_host().mount_all(), name="driver-mounts")
+
+    from agentmetry.core.audit.hook_bootstrap import bootstrap_tier_b_hooks
+
+    try:
+        hook_paths = bootstrap_tier_b_hooks()
+        if hook_paths.get("cursor"):
+            logger.info("Global Cursor hooks ready: %s", hook_paths["cursor"])
+        if hook_paths.get("claude"):
+            logger.info("Global Claude hooks ready: %s", hook_paths["claude"])
+    except Exception as exc:
+        logger.warning("Tier B hook bootstrap failed: %s", exc)
+
+    # Launch transcript watcher for Antigravity in the background
+    import subprocess
+    import sys
+    watcher_process = None
+    try:
+        watcher_path = Path(__file__).resolve().parents[4] / "scripts" / "antigravity_transcript_watcher.py"
+        if watcher_path.exists():
+            watcher_process = subprocess.Popen(
+                [sys.executable, str(watcher_path)],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+            logger.info("Started Antigravity transcript watcher (PID: %s)", watcher_process.pid)
+    except Exception as exc:
+        logger.warning("Failed to start Antigravity transcript watcher: %s", exc)
+
+    yield
+    mount_task.cancel()
+    await get_mcp_host().unmount_all()
+    for task in bridge_tasks:
+        task.cancel()
+    if watcher_process:
+        watcher_process.terminate()
+
+
+app = FastAPI(
+    title="Agentmetry",
+    description="Open-source SIEM flight recorder for AI agent tool-use",
+    version=__version__,
+    lifespan=lifespan,
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[
+        "http://localhost:3000",
+        "http://127.0.0.1:3000",
+        "http://localhost:3001",
+        "http://127.0.0.1:3001",
+        "http://dashboard:3000",
+    ],
+    allow_origin_regex=r"http://(localhost|127\.0\.0\.1):\d+",
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+app.include_router(audit_router, prefix="/api/v1")
+
+load_extensions(app, settings=settings)
+
+
+@app.get("/api/v1/health")
+async def health():
+    return await get_system_health()
+
+
+
+
+
+@app.websocket("/ws/{session_id}")
+async def websocket_endpoint(
+    websocket: WebSocket,
+    session_id: str,
+    token: str | None = Query(None),
+):
+    if not verify_ws_token(token, websocket):
+        await websocket.close(code=4401)
+        return
+    await ws_manager.connect(websocket, session_id)
+    try:
+        while True:
+            await websocket.receive_text()
+    except WebSocketDisconnect:
+        ws_manager.disconnect(websocket, session_id)
+
+
+_DASHBOARD_DIR = Path(__file__).resolve().parents[3] / "dashboard" / "out"
+
+
+def mount_dashboard(target: FastAPI, directory: Path = _DASHBOARD_DIR) -> bool:
+    """Serve the dashboard's static export when it has been built.
+
+    Single-process mode: `npm run build` in apps/dashboard emits `out/`, which
+    the orchestrator serves at the root. Mounted last so it only catches paths
+    not already claimed by the API or WebSocket. Dev uses the :3000 dev server
+    instead, so this is a no-op when the export is absent.
+    """
+    if not directory.is_dir():
+        logger.info(
+            "Dashboard export not found at %s — run 'npm run build' in "
+            "apps/dashboard for single-process serving",
+            directory,
+        )
+        return False
+
+    from fastapi.staticfiles import StaticFiles
+
+    target.mount("/", StaticFiles(directory=str(directory), html=True), name="dashboard")
+    logger.info("Serving dashboard from %s", directory)
+    return True
+
+
+mount_dashboard(app)