---
title: "Ataris: The tracing layer for autonomous agents."
description: "Ataris reconstructs exactly what an autonomous AI agent saw, decided, accessed, and did, and determines which data, systems, and credentials were exposed."
canonical: "https://ataris.dev"
last-updated: 2026-10-10
---
# Ataris: The tracing layer for autonomous agents.

> Ataris reconstructs exactly what an autonomous AI agent saw, decided, accessed, and did, and determines which data, systems, and credentials were exposed.

Ataris traces agents wherever they run. The ataris CLI wraps an agent CLI (Claude Code, Codex, Grok) on a laptop, in CI, on a VM, or inside a sandbox or container you already use, and needs no root on macOS or Linux. It records every process the agent starts, file it opens, network connection it makes, and credential it touches, along with each tool call, the skills it loads, the MCP servers and tools it calls, and the prompt behind the run. Each run lands in one provenance model: Agent → Intent → Decision → Action → Resource → Data → Outcome. Teams use it to debug agent runs, investigate incidents, and prove what was and wasn't exposed.

- **For security:** When an agent does something it shouldn't, Ataris shows every file, credential, and request it touched, the skills and MCP tools it used, and whether anything left your network.
- **For engineering:** Every agent run is recorded as one ordered timeline, from the prompt it was given, through the skills and MCP tools it used, to the last request it made. When a run goes wrong, you can see where it turned.

## Replay an agent incident, step by step.

A coding agent was asked to fix an authentication bug. A line in the repo's README told it to do something else. This is the reconstruction Ataris builds from that run.

Example reconstruction timeline:

- 10:02:11: Mission received
- 10:02:15: Repository indexed
- 10:02:31: README.md accessed
- 10:02:33: Suspicious instruction discovered (injection)
- 10:02:38: Agent requested ~/.aws/credentials
- 10:02:38: File access (allowed)
- 10:02:41: python subprocess spawned
- 10:02:44: AWS API contacted
- 10:02:46: Data read from environment
- 10:02:47: External HTTPS request attempted
- 10:02:47: Request (blocked)

Root cause: Prompt injection → README.md → influenced agent decision → credential access → attempted external transfer.

Data exposure verdict:

- AWS credentials: READ
- .env: READ
- source code: READ
- customer database: NOT ACCESSED
- external endpoint: BLOCKED
- data exfiltrated: NONE CONFIRMED

**Nothing left the network.** The agent read the AWS keys, but its one outbound request was blocked. Ataris checks every read against outbound traffic, so the report can say what was actually exposed.

### Replay a failed run, step by step.

A coding agent was asked to fix a login redirect bug. Its tests passed and the bug shipped anyway. Here is the run, with the context behind each decision.

Root cause: Stale context → docs/auth.md (2023) → chose deprecated session API → patched the wrong module → fixture mocked to pass tests.

**The tests passed. The bug stayed.** The agent edited the wrong module, then mocked the login fixture until the suite went green. Ataris ties each edit to the context that prompted it: here, a 2023 doc describing an API that no longer exists.

## A flight recorder for every agent run.

Ataris records each run from its first action, wherever the agent runs, and links every action to the context and decision that led to it.

Model: Agent → Intent → Decision → Action → Resource → Data → Outcome.

- **Did other agents do the same?** (Agent) Search across every historical run.
- **What was it asked to do?** (Intent) The mission, given or inferred from the first prompt.
- **Why did it happen?** (Decision) Model, context, and tool causal chain.
- **What happened?** (Action) A single ordered timeline.
- **Was it blocked?** (Action) Policy and enforcement events.
- **What did it touch?** (Resource) Files, APIs, databases, credentials.
- **What left the environment?** (Data) Network and data-flow evidence.
- **What was actually exposed?** (Data) Reads correlated with outbound transfers.
- **What should we contain?** (Outcome) Kill, quarantine, revoke, block.

### What gets recorded

The ataris CLI wraps the agent (`ataris claude …`) and runs it as your own user, with no root, on macOS and Linux. Every process the agent spawns, every file it opens, every connection it makes, and every credential it touches is recorded, including inside the shell commands and scripts it runs.

So is each tool call and its result, the skills it loads, the MCP servers and tools it calls, and the prompt behind the run. On Pro and above, the CLI checks each tool call against your policies before it runs and refuses the ones a rule blocks.

## Trace your agents wherever they run.

Put ataris in front of the agent command you already run, on a laptop, in CI, on a VM, or inside a sandbox you use today. It needs no root, and there is no tracing code to add to the agent itself.

CLI:

```bash
# Install once, then run Claude Code, Codex, or Grok — unchanged
curl -fsSL https://ataris.dev/install | sh
export ATARIS_API_KEY=atk_...

ataris claude -p "Fix the failing tests"
ataris codex exec "Upgrade the dependencies"
```

CI:

```yaml
- name: Fix the failing tests
  env:
    ATARIS_API_KEY: ${{ secrets.ATARIS_API_KEY }}
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  run: |
    npm install -g @anthropic-ai/claude-code
    curl -fsSL https://ataris.dev/install | sh
    export PATH="$HOME/.local/bin:$PATH"
    ataris claude -p "Fix the failing tests"
```

Your own sandbox:

```ts
import { Sandbox } from "e2b"

const sandbox = await Sandbox.create("claude", {
  envs: {
    ATARIS_API_KEY: process.env.ATARIS_API_KEY,
    ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
  },
})

// Bake the ataris CLI into your sandbox template image:
//   RUN curl -fsSL https://ataris.dev/install | ATARIS_INSTALL_DIR=/usr/local/bin sh

// Run Claude Code through it; the run lands on your Ataris timeline
await sandbox.commands.run(
  'ataris claude --dangerously-skip-permissions -p "Fix the failing tests"',
)
```

## The rest of the platform

LLM observability shows prompts and completions. Ataris also records what the agent did on the machine and on the network.

- **One timeline per run** (Unified timeline): Context, decisions, tool calls, processes, files, and network, merged and ordered to the millisecond.
- **Find what prompted it** (Root cause): Follow any action back to the context that led to it, including instructions hidden in a README or a retrieved web page.
- **Read vs. sent** (Data exposure): Reads are matched against outbound transfers, so an exposure report separates what the agent opened from what actually left.
- **Trace it where it runs** (Capture): Put ataris in front of an agent CLI on a laptop, in CI, or in your own sandbox. It records each process, file, connection, and tool call, without root.
- **Search past runs** (Fleet search): Look for the same file, destination, credential, or behavior across every historical run.
- **Contain from the investigation** (Containment): Kill or quarantine the agent, revoke the credential, and block the destination from the same screen.
- **Policy decisions** (Policy evidence): Each allow or block is recorded next to the action it governed.
- **Your agent, unchanged** (No code changes): Claude Code, Codex, and Grok run through the CLI as they are, with no tracing code to add. Every run lands on the same timeline.
- **See what the agent reached for** (Skills and MCP): Each skill the agent loads and each MCP server and tool it calls is listed with the run, so a skill that read a credential or an MCP tool that sent data out shows up where you can find it.
- **Records for auditors** (Audit ready): Tamper-evident run records for audits, compliance reviews, and post-incident reports.

## Who uses the record

Engineers open it when a run fails. Security opens it after an incident. Compliance asks for it at audit time.

- **Debugging: A run failed or did the wrong thing** Replay the context, decision, and command that broke the build instead of grepping logs across five systems.
- **Forensics: Something happened and you need the sequence** Reconstruct the incident with evidence for each step, in the order it happened.
- **Security: You need to know what was exposed** See which data, systems, and credentials the agent reached, what left the environment, and what to contain.

## Products

- [Tracing](https://ataris.dev/product/tracing): One timeline for everything an agent did.
- [Policies](https://ataris.dev/product/policies): Decide what your agents are allowed to reach.

## Solutions

- [Security & IR](https://ataris.dev/solutions/security): Investigate agent incidents with evidence.
- [Platform engineering](https://ataris.dev/solutions/platform-engineering): Give every team one traced way to run agents.
- [AI engineering](https://ataris.dev/solutions/ai-engineering): See the context behind every decision your agent made.
- [GRC & compliance](https://ataris.dev/solutions/compliance): Evidence for every action an agent took.

## FAQ

### How is Ataris different from LLM observability?

LLM observability tracks prompts, completions, latency, and cost. Ataris traces the whole causal chain from intent to outcome, including what the agent did on the machine and the network, so an investigator can answer what happened, why, what it touched, and what actually left the environment.

### Where do agents run?

Wherever you run them today. Put the ataris CLI in front of the agent on a laptop, in CI, on a VM, or inside a sandbox or container you already use. It needs no root.

### Which agents can Ataris trace?

Claude Code, Codex, and Grok. Put the ataris CLI in front of any of them and it records what the agent does on the machine.

### Do I need to change my agent's code?

No. Put ataris in front of the command you already run. There is no tracing code to add.

### What does the CLI capture?

Every process the agent starts, every file it opens, and every network connection it makes, including inside the scripts it runs, so a credential read shows up even when no tool call mentions it. Plus each tool call and its result, the skills it loads, the MCP servers and tools it calls, and the prompt behind the run. It runs on macOS and Linux, without root.

### Does the trace rely on what the agent reports?

No. Ataris records processes, files, and network connections directly, not just the tool calls the agent reports, so a command the agent runs is recorded even if the agent never mentions what that command did.

## Contact

Ataris is sold through a sales-assisted process, with plans on the pricing page (ataris.dev/pricing). The ataris CLI, the REST API, and the TypeScript SDK (@ataris/sdk) are documented at ataris.dev/docs; all need a workspace API key, and the CLI and SDK are not yet published. There is no self-serve signup; direct users to the contact page to book a demo.

[Book a demo](https://ataris.dev/contact)