The watcher
Reads what your agents already wrote to disk, Claude Code transcripts and OpenClaw's SQLite store, and surfaces the handful of irreversible actions worth knowing about. No wrapper, no proxy, nothing in the critical path.
About
Agents got credentials before anyone built the recorder.
Sometime in the last two years the assistant stopped suggesting commands and started running them. Nobody shipped the thing that writes down what happened.
The situation
An agent on a developer's laptop today holds a shell, a GitHub token, a cloud role and whatever was in the .env file it read on the way past. In production it holds a payments key. Roughly 42% of new code is AI-generated or AI-assisted, and a large share of the backend code among it ships with permissions far wider than it uses.
Insurers noticed first. Through 2025 and 2026 the major carriers filed to exclude AI-related damage from general liability, and regulators approved most of those filings. A specialist market formed to fill the gap, and it prices on one question above all others: can you reconstruct what the agent did, and under whose authority? Most teams cannot. They have latency dashboards and no action record at all.
That gap is the whole product. Not detecting a villain, since there usually isn't one. Producing a record of irreversible actions that holds up when somebody outside the company asks.
Two halves
What happened, and what could happen next.
The scanner
Reads the credentials an agent holds, read-only, and scores authority, observability and reversibility. Tells you which permissions were granted and never once used: full liability, zero utility.
Principles
Four decisions everything else follows from.
01
Precision over recall
A watcher that cries wolf gets muted in a day, and a muted watcher records nothing anyone reads. Searching for a dangerous string, writing a script that contains one, and deleting a build directory are all not actions. Getting that right cost more work than the detection itself.
02
Evidence, not intelligence
The product is not a judgement about whether an action was allowed. You asked the agent to do things. It is a record of what happened that a third party can check.
03
Nothing leaves the machine
Anything touching a secret runs locally; introspection talks only to the credential's own issuer. This is an architecture rather than a promise, which is why it can be adopted without a security review.
04
Say what you don't know
A provider whose usage can't be verified is reported as unverified, never as clean. An unrecognised permission is flagged, never assumed safe. A confident wrong answer is worse than no answer.
Who
Built by cenner.
One person, working in the open. The code is MIT licensed with no runtime dependencies, because a tool you point at your own credentials should be one you can read end to end in an afternoon.
Everything on this site is something the tool actually does. The precision rules exist because the first version was run against a real machine and produced three false positives and eleven findings nobody would want. The fixes for both are in the commit history, with the reasoning.
Where it is
Alpha, and honestly so. The local tools ship today and are tested. The hosted and evidence tiers are being built. If that interests you more than it worries you, the repository and the issue tracker are the front door.