DEDUPED Hot AI repos, turned into use cases Get 5 a day

What you can do with Tracekit

Tracekit is a Python tool that gates each AI agent tool call before it runs, signs every call and decision into a tamper-evident hash chain, and lets anyone verify each run offline.

Trended earlier

Cygnux-Labs/Tracekit on GitHub

Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk.

What do you want to do?

4 use cases

  • See a denied command and a tamper check in 5 seconds

    Run the built-in demo to watch a risky shell call get denied and a rewritten record fail verification.

    View prompt
    In an empty working directory <workdir>, run `uvx --from tracekit-ai tracekit demo --server` and capture its output. Expect an agent run section with Bash 'sudo rm -rf /' marked deny, a line 'Integrity: VERIFIED.', then a tamper test ending in 'Integrity: FAILED.'. Verify that the tamper test failure names a specific seq record.

  • Record every tool call of a Python agent run

    Add two lines to a Python agent so each tool and model call is gated, signed, and checked after the run.

    View prompt
    In the project at <project-path>, install tracekit-ai with `pip install tracekit-ai`, add `import tracekit; tracekit.instrument()` as the first line of <agent-file>, run the agent, then run `tracekit last`. Expect output containing 'Integrity: VERIFIED.' and an Assurance line. Verify that the Assurance line says dev, since this is a dev signer.

  • Check a run file offline against a key you pinned

    Verify a .tkb run file with only the verifier and a public key, and see a tampered copy fail.

    View prompt
    In the Cygnux-Labs/Tracekit checkout at <repo-path>, run `pip install --no-deps tracekit-ai`, then `tracekit verify docs/sample/demo-run.tkb --key docs/sample/signer.pub` and the same command on docs/sample/demo-run-tampered.tkb. Expect exit 0 for the intact file and exit 1 for the tampered file. Verify that the tampered file's failure points to a specific record.

  • Compare what an agent was asked, said, and did

    Record a v2 coding-agent run and run analysis that compares the request, the model's account, and what ran.

    View prompt
    In the project at <project-path>, run `pip install tracekit-ai` and `tracekit init --dev --v2`, complete one short coding-agent session, then run `tracekit analyze --v2`. Expect findings comparing requested, reported, and executed actions. Verify that the integrity status from `tracekit last` is reported separately from the findings.

How to use Tracekit

  1. Check you have what it needs: Python 3.9 to 3.13 (framework integrations need 3.10 or newer), or uv for the one-line demo; A terminal on your own machine; runs on your own machines per the README; Dev mode runs as your user, so it protects nothing against an agent running as you.
  2. Open Cygnux-Labs/Tracekit on GitHub and read the README and license.
  3. Install uv from https://docs.astral.sh/uv/ if you do not have it.
  4. Run uvx --from tracekit-ai tracekit demo --server.
  5. Read the agent run lines: Bash 'sudo rm -rf /' shows deny, and the first Integrity line says VERIFIED.
  6. Read the tamper test: the rewritten copy shows [FAIL] signatures and Integrity: FAILED at the changed record.

These steps come from our top use case, See a denied command and a tamper check in 5 seconds, which also has a copy-paste agent prompt.

Tracekit alternatives · Best AI repos for Security and science

About this repo

  • Who it is forBuilt for developers and security or audit reviewers who need to see what an AI agent did, whether it was allowed, and whether the record can be trusted.
  • Why it is hot
  • LanguagePython
  • Sourcegithub.com/Cygnux-Labs/Tracekit · Back to Hot repos

Requirements

  • Python 3.9 to 3.13 (framework integrations need 3.10 or newer), or uv for the one-line demo
  • A terminal on your own machine; runs on your own machines per the README
  • Dev mode runs as your user, so it protects nothing against an agent running as you
Maintain Tracekit? Add the Featured on Deduped badge

Paste this into your README:

[![Featured on Deduped](https://dedupedai.com/badge/cygnux-labs-tracekit.svg)](https://dedupedai.com/use-cases/cygnux-labs-tracekit/?ref=badge)

More badge styles and HTML

Questions about Tracekit

What is Tracekit?

Tracekit is a Python tool that gates each AI agent tool call before it runs, signs every call and decision into a tamper-evident hash chain, and lets anyone verify each run offline. It is an open-source project on GitHub: https://github.com/Cygnux-Labs/Tracekit.

Who is Tracekit for?

Built for developers and security or audit reviewers who need to see what an AI agent did, whether it was allowed, and whether the record can be trusted.

What can I do with Tracekit?

4 use cases so far, for example: See a denied command and a tamper check in 5 seconds; Record every tool call of a Python agent run; Check a run file offline against a key you pinned. Each has steps and a copy-paste agent prompt.

What do I need to run Tracekit?

Python 3.9 to 3.13 (framework integrations need 3.10 or newer), or uv for the one-line demo; A terminal on your own machine; runs on your own machines per the README; Dev mode runs as your user, so it protects nothing against an agent running as you.

What are alternatives to Tracekit?

Other hot AI repos in Security and science: Rea, Reverify, Ablation, Claude AD, Awesome Reverse Engineered.

Is Tracekit safe to run?

Deduped does not own, audit or vouch for it. Read the README and license, run it on your own systems first and review every command before you run it.