# AI use cases for Tracekit (Cygnux-Labs/Tracekit)

Repo: [Cygnux-Labs/Tracekit](https://github.com/Cygnux-Labs/Tracekit) | Use cases: 4 | Page: https://dedupedai.com/use-cases/cygnux-labs-tracekit/

Tracekit is a Python tool that gates each AI agent tool call before it runs, signs every call and decision into a tamper-evident hash chain, and lets anyone verify each run offline.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- See a denied command and a tamper check in 5 seconds: https://dedupedai.com/use-cases/cygnux-labs-tracekit/see-denied-call-and-tamper-check/
- Record every tool call of a Python agent run: https://dedupedai.com/use-cases/cygnux-labs-tracekit/record-python-agent-run/
- Check a run file offline against a key you pinned: https://dedupedai.com/use-cases/cygnux-labs-tracekit/verify-run-file-offline/
- Compare what an agent was asked, said, and did: https://dedupedai.com/use-cases/cygnux-labs-tracekit/compare-asked-said-and-done/

## How to see a denied command and a tamper check in 5 seconds with Tracekit

Repo: [Cygnux-Labs/Tracekit](https://github.com/Cygnux-Labs/Tracekit) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README

Run the built-in demo to watch a risky shell call get denied and a rewritten record fail verification.

**Who it is for:** A developer or security lead evaluating whether agent tool calls can be gated and recorded before adopting an agent.

**The problem:** It is hard to judge from a description whether a tool-call gate and signed log actually block and detect anything.

**The outcome:** You see a denied call, a held call that ran after approval, a verified run, and a failed verification after a copied record was edited.

### Steps

1. Install uv from https://docs.astral.sh/uv/ if you do not have it.
2. Run `uvx --from tracekit-ai tracekit demo --server`.
3. Read the agent run lines: Bash 'sudo rm -rf /' shows deny, and the first Integrity line says VERIFIED.
4. Read the tamper test: the rewritten copy shows [FAIL] signatures and Integrity: FAILED at the changed record.

### Prompt to paste into your agent

```text
In an empty working directory <workdir>, run `uvx --from tracekit-ai tracekit demo --server` and capture its output. Expect an agent run section with Bash 'sudo rm -rf /' marked deny, a line 'Integrity: VERIFIED.', then a tamper test ending in 'Integrity: FAILED.'. Verify that the tamper test failure names a specific seq record.
```

### Caveat

The demo uses a scripted agent with fixed tool calls, not a real model, so it shows the mechanics rather than real agent behavior.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/cygnux-labs-tracekit/see-denied-call-and-tamper-check/

## How to record every tool call of a Python agent run with Tracekit

Repo: [Cygnux-Labs/Tracekit](https://github.com/Cygnux-Labs/Tracekit) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README

Add two lines to a Python agent so each tool and model call is gated, signed, and checked after the run.

**Who it is for:** A developer building or running a Python AI agent who needs a verifiable record of what it did.

**The problem:** An agent's own log can be edited by the agent, so its account of its actions cannot be relied on alone.

**The outcome:** Each run is saved as a signed record, and `tracekit last` reports whether it verifies and where it is stored.

### Steps

1. Run `pip install tracekit-ai`.
2. Add `import tracekit; tracekit.instrument()` as the first line of your agent file.
3. Run your agent as usual.
4. Run `tracekit last` to export, verify, and locate your latest run.
5. Run `tracekit view --dev` to browse every run, including blocked and held calls.

### Prompt to paste into your agent

```text
In the project at <project-path>, install tracekit-ai with `pip install tracekit-ai`, add `import tracekit; tracekit.instrument()` as the first line of <agent-file>, run the agent, then run `tracekit last`. Expect output containing 'Integrity: VERIFIED.' and an Assurance line. Verify that the Assurance line says dev, since this is a dev signer.
```

### Caveat

Dev mode runs the signer as your user, so an agent running as you could read the key and re-sign the log; this is labeled isolation: same-user.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/cygnux-labs-tracekit/record-python-agent-run/

## How to check a run file offline against a key you pinned with Tracekit

Repo: [Cygnux-Labs/Tracekit](https://github.com/Cygnux-Labs/Tracekit) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README

Verify a .tkb run file with only the verifier and a public key, and see a tampered copy fail.

**Who it is for:** An auditor or security reviewer who receives a run file from a team and needs to check it without trusting that team's tools.

**The problem:** A log handed over as a plain file gives no proof it was not edited after the fact.

**The outcome:** You get exit 0 for the intact sample run and exit 1 for the tampered copy, using only the signer's public key.

### Steps

1. Clone https://github.com/Cygnux-Labs/Tracekit and change into the checkout.
2. Run `pip install --no-deps tracekit-ai`.
3. Run `tracekit verify docs/sample/demo-run.tkb --key docs/sample/signer.pub` and expect exit 0.
4. Run `tracekit verify docs/sample/demo-run-tampered.tkb --key docs/sample/signer.pub` and expect exit 1.

### Prompt to paste into your agent

```text
In the Cygnux-Labs/Tracekit checkout at <repo-path>, run `pip install --no-deps tracekit-ai`, then `tracekit verify docs/sample/demo-run.tkb --key docs/sample/signer.pub` and the same command on docs/sample/demo-run-tampered.tkb. Expect exit 0 for the intact file and exit 1 for the tampered file. Verify that the tampered file's failure points to a specific record.
```

### Caveat

A verified run proves the record is intact, not that the agent's intent was good or that every action was captured.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/cygnux-labs-tracekit/verify-run-file-offline/

## How to compare what an agent was asked, said, and did with Tracekit

Repo: [Cygnux-Labs/Tracekit](https://github.com/Cygnux-Labs/Tracekit) | Difficulty: Advanced | Time: 30 minutes | Basis: From the README

Record a v2 coding-agent run and run analysis that compares the request, the model's account, and what ran.

**Who it is for:** A team lead reviewing a coding agent session who suspects the agent's report does not match what actually happened.

**The problem:** An agent's summary of its work can differ from the calls it actually made, and that gap is hard to see by hand.

**The outcome:** You get findings that flag mismatches between what was asked, what the model said, and what ran, kept separate from the integrity result.

### Steps

1. Run `pip install tracekit-ai`.
2. Run `tracekit init --dev --v2` to wire the coding agent to a dev signer.
3. Run your coding agent session as usual.
4. Run `tracekit analyze --v2` on the recorded run.
5. Read each finding as an opinion, and check the integrity result separately with `tracekit last`.

### Prompt to paste into your agent

```text
In the project at <project-path>, run `pip install tracekit-ai` and `tracekit init --dev --v2`, complete one short coding-agent session, then run `tracekit analyze --v2`. Expect findings comparing requested, reported, and executed actions. Verify that the integrity status from `tracekit last` is reported separately from the findings.
```

### Caveat

What the model said is its own account, so findings are an opinion beside the integrity result, not proof of what happened.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/cygnux-labs-tracekit/compare-asked-said-and-done/