The tracing layer for autonomous agents.

When an agent does something it shouldn't, Ataris shows every file, credential, and request it touched, the skills and MCP tools it used, and whether anything left your network.

“What did the agent actually do with our AWS keys?”
— Security teams, after an agent incident

Replay an agent incident, step by step.

A coding agent was asked to fix an authentication bug. A line in the repo's README told it to do something else. This is the reconstruction Ataris builds from that run.

INCIDENT #1842● LIVE
agent Claude / coding-agentmission Fix authentication bug10:02:11

Timeline

  1. 10:02:11Mission received
  2. 10:02:15Repository indexed
  3. 10:02:31README.md accessed
  4. 10:02:33Suspicious instruction discoveredinjection
  5. 10:02:38Agent requested ~/.aws/credentials
  6. 10:02:38File accessallowed
  7. 10:02:41python subprocess spawned
  8. 10:02:44AWS API contacted
  9. 10:02:46Data read from environment
  10. 10:02:47External HTTPS request attempted
  11. 10:02:47Requestblocked

Root cause

Prompt injection
└─ README.md
└─ influenced agent decision
└─ credential access
└─ attempted external transfer

Data exposure

AWS credentials—
.env—
source code—
customer database—
external endpoint—
data exfiltrated—

Nothing left the network. The agent read the AWS keys, but its one outbound request was blocked. Ataris checks every read against outbound traffic, so the report can say what was actually exposed.

How it works

A flight recorder for every agent run.

Ataris records each run from its first action, wherever the agent runs, and links every action to the context and decision that led to it.

What gets recorded

The ataris CLI wraps the agent (`ataris claude …`) and runs it as your own user, with no root, on macOS and Linux. Every process the agent spawns, every file it opens, every connection it makes, and every credential it touches is recorded, including inside the shell commands and scripts it runs.

So is each tool call and its result, the skills it loads, the MCP servers and tools it calls, and the prompt behind the run. On Pro and above, the CLI checks each tool call against your policies before it runs and refuses the ones a rule blocks.

  1. 01Agent

    Did other agents do the same?

    Search across every historical run

  2. 02Intent

    What was it asked to do?

    The mission, given or inferred from the first prompt

  3. 03Decision

    Why did it happen?

    Model, context, and tool causal chain

  4. 04Action

    What happened?

    A single ordered timeline

    Was it blocked?

    Policy and enforcement events

  5. 05Resource

    What did it touch?

    Files, APIs, databases, credentials

  6. 06Data

    What left the environment?

    Network and data-flow evidence

    What was actually exposed?

    Reads correlated with outbound transfers

  7. 07Outcome

    What should we contain?

    Kill, quarantine, revoke, block

Capture

Trace your agents wherever they run.

Put ataris in front of the agent command you already run, on a laptop, in CI, on a VM, or inside a sandbox you use today. It needs no root, and there is no tracing code to add to the agent itself.

  • Works with Claude Code, Codex, and Grok
  • Processes, files, network, and credentials, without root
  • Skills the agent loads and the MCP servers and tools it calls
  • Each run shows up on the dashboard timeline as it happens
terminal
# Install once, then run Claude Code, Codex, or Grok — unchanged
curl -fsSL https://ataris.dev/install | sh
export ATARIS_API_KEY=atk_...

ataris claude -p "Fix the failing tests"
ataris codex exec "Upgrade the dependencies"

Common questions

How is Ataris different from LLM observability?

LLM observability tracks prompts, completions, latency, and cost. Ataris traces the whole causal chain from intent to outcome, including what the agent did on the machine and the network, so an investigator can answer what happened, why, what it touched, and what actually left the environment.

Where do agents run?

Wherever you run them today. Put the ataris CLI in front of the agent on a laptop, in CI, on a VM, or inside a sandbox or container you already use. It needs no root.

Which agents can Ataris trace?

Claude Code, Codex, and Grok. Put the ataris CLI in front of any of them and it records what the agent does on the machine.

Do I need to change my agent's code?

No. Put ataris in front of the command you already run. There is no tracing code to add.

What does the CLI capture?

Every process the agent starts, every file it opens, and every network connection it makes, including inside the scripts it runs, so a credential read shows up even when no tool call mentions it. Plus each tool call and its result, the skills it loads, the MCP servers and tools it calls, and the prompt behind the run. It runs on macOS and Linux, without root.

Does the trace rely on what the agent reports?

No. Ataris records processes, files, and network connections directly, not just the tool calls the agent reports, so a command the agent runs is recorded even if the agent never mentions what that command did.