System overview // tracce

Observe the real operating-system activity behind Claude Code and Codex sessions.

tracce is a macOS kernel-event tracer for coding-agent sessions. It records every descendant process, file operation, command, and network connection, then presents the result as a live terminal dashboard or a replayable session.

agent intent ──┐
               ├──> tracce session ──> live dashboard / JSONL replay
kernel events ─┘

Start here

Install tracce

Homebrew, Cargo, and source installation.

Command reference

Launch, attach, replay, export, and import.

Keyboard shortcuts

Navigate every pane without leaving the keyboard.

Security model

What uses root, what never does, and why.

What gets captured

Signal	Source	What you see
Processes	macOS Endpoint Security	descendant tree, PID, event count
Files	macOS Endpoint Security	open, write, create, delete, rename
Agent intent	local Claude/Codex history	tool calls and requested commands
Network	`lsof -i` polling	remote host and connection count
Rate	session aggregator	events per second over time

Observe, don't contain

tracce is an audit and observability tool, not a sandbox. It reports activity but does not block or modify it.

Requirements

macOS 13 or later
Full Disk Access for your terminal application
A Claude Code or Codex CLI installation
sudo only when enabling Apple's eslogger event source

Continue with installation or jump directly to the shortcut map.

System overview