Agentmetry

About Agentmetry

Agentmetry is a local flight recorder for AI coding agents, written for the security engineer who found out their company was running Cursor by reading a pull request. Endpoint detection sees a process; it does not see that an agent read a private SSH key and then made an outbound network call in the same session. Agentmetry records agent activity at the tool boundary — every read, shell command and fetch — correlates the sequence, tags it against MITRE ATT&CK technique IDs, and raises a single critical alert for the pattern rather than a stream of individually unremarkable events. The worked example on the homepage is exactly that: a `cat ~/.ssh/id_rsa` read tagged T1552.004, an `aws configure list` shell call tagged T1059 with DLP flagging an AWS access key, and a WebFetch to a paste site tagged T1071.001, correlated into one credential-exfil finding. Secret values themselves are never written to the trail. It runs entirely on the machine with zero cloud calls, ships nine detection rules in the current phase, and emits in a format existing SIEMs already read, so it slots into an established pipeline rather than becoming another console. Install is a git clone plus `pip install -e`, with a PowerShell installer for Windows. The whole thing is Apache-2.0 open source with the code public, which matters for a tool whose entire value proposition is that it watches privileged activity.

Key Features

Agentmetry Pros & Cons

Who Is Agentmetry Best For?

Tags