SYSTEM ONLINETRACCE v0.3.2CAPTURE: PROCESS // FILE // NETWORKMACOS_13+

admin@mac:~$ tracce codex, then admin@mac:~$ tracce view

SEE WHAT YOUR
CODING AGENT
REALLY DOES.

A macOS kernel-event tracer for Claude Code and Codex. Every process, file, command, and network connection — live in your terminal or replayed later.

[ INITIATE INSTALL ] [ VIEW SOURCE ]
$brew install chungchihhan/tap/tracce
PLATFORMmacOS 13+
SOURCEEndpoint Security
RUNTIMERust
LICENSEMIT

// 00_PRODUCT_VIEW

KERNEL TRUTH. HUMAN READABLE.

One terminal dashboard. Five panes. Zero guesswork.

● TRACCE // SESSION: 20260809_140211[LIVE] [PID 1842] [72 EVT/S]
tracce terminal dashboard showing process tree, file activity, commands, network connections, and events per second
1:PROCESS 2:ACTIVITY 3:COMMANDS 4:NETWORK 5:EVENTS/Sq:QUIT

// 01_SIGNAL_MATRIX

NOTHING HIDDEN.

tracce correlates operating-system events with agent intent, giving you a legible audit trail while the work is still happening.

01

PROCESS TREE

Follow every descendant process your agent spawns, with event counts attached.

[PID: 1842] [CHILDREN: 07]
02

FILE ACTIVITY

See reads, writes, creates, deletes, and renames — with sensitive paths flagged.

[OPEN] ~/.ssh/config ⚠
03

COMMAND INTENT

Put agent tool calls next to kernel truth so claimed intent and real activity stay visible.

[$] git status --short
04

NETWORK

Track remote hosts and connection counts without installing a daemon or proxy.

[TCP] api.openai.com × 12

// 02_EXECUTION_FLOW

THREE COMMANDS. FULL VISIBILITY.

STEP_01$ brew install
chungchihhan/tap/tracce

Install from the Homebrew tap.

STEP_02$ tracce codex
# or: tracce claude

Start and record your agent.

STEP_03$ tracce view
# choose a session

Watch live or replay it later.

[!] ACTIVE DEFENSE LAYER

RISK DOESN'T
SCROLL PAST UNSEEN.

Sensitive paths and risky commands are flagged at the moment of access. Ship your own warning and critical glob patterns in ~/.tracce/flags.json.

  • [WARN] reads to .env, ~/.ssh, and credential files
  • [CRIT] destructive or privileged commands
  • [EDIT] changes apply on the next session switch
READ THE SECURITY MODEL →
● ALERT STREAM[FILTER: FLAGGED]
[ VERIFIED ]

// 03_TRUST_BOUNDARY

ROOT ACCESS, CONTAINED.

Only Apple's signed /usr/bin/eslogger runs as root, with a hardcoded read-only event list. tracce itself never does.

[OK] NO DAEMON

[OK] NO SETUID BINARY

[OK] NO USER INPUT IN SUDO

[OK] POLL-ONLY FALLBACK

READY_TO_TRACE?

YOUR AGENT HAS A LOG.
NOW YOU CAN READ IT.

[ GET STARTED ][ VIEW SHORTCUTS ]