Runtime security monitoring for AI coding agents
Capture what AI tools do on your machine — conversations from Claude Code, browser AI, and local models comprehensively, with documented limits for desktop AI apps. File changes, install commands, and credential exposure across all surfaces.
AI agents install dependencies, read secrets, and call APIs on your machine — often unattended.
An agent can run an install command and an outbound network call in the same turn, while you're asleep. Existing tools weren't built to watch that moment: EDR watches for malware, static scanners inventory your manifest. Neither watches the agent that installs the dependency, writes the code, and touches credentials at 3 AM.
The TanStack npm packages were compromised — 84 malicious versions published by the project's own release pipeline, carrying valid signed SLSA provenance. They looked legitimate to every tool checking cryptographic proof of origin, and the worm spread to Mistral AI's SDK on PyPI (the malicious mistralai 2.4.6). What caught it fast wasn't the provenance check — it was behavioral analysis at install time. That's the layer Vigil watches: what your AI agents try to install, as they try it.
Sources: TanStack postmortem · Snyk · OpenAI incident response, May 2026.Capture, detect, and trace — continuously.
Set up once. Vigil captures from the runtime layer — no code changes, no SDK, no sampling.
Four-layer monitoring
API traffic via an AI-only HTTPS proxy, Claude Code session transcripts, browser AI through a Chrome extension, and process / filesystem / network observation. Coverage varies by surface — see the honest capture matrix.
Credential leak detection
Scans every captured prompt and response for 15+ patterns — AWS keys, GitHub tokens, API keys, JWTs, private keys, Luhn-validated cards. Severity-ranked, with drill-down to the exact conversation turn. Masked on display, auto-purged after 30 days.
Supply chain intelligence
Parses every install command an agent runs — npm, yarn, pnpm, pip, cargo, go get, gem, brew, apt, npx — and checks it against typosquat dictionaries and CVE data from OSV.dev, with threat-intel correlation from URLhaus and ThreatFox.
Four layers of visibility, set up once.
| Layer | What it captures | How |
|---|---|---|
| AI API traffic | Prompts, responses, token counts, and tool calls from agents that route through the HTTPS proxy. Coverage varies by app — see the per-surface matrix below. | mitmproxy addon, selective SSL inspection — AI API hostnames only (X.509 NameConstraints) |
| CLI agent sessions | Full Claude Code transcripts including system prompts, file reads, bash commands, and tool use | JSONL transcript tailing under ~/.claude/projects/ |
| Browser AI | Claude Web, ChatGPT, and Gemini conversations — verified end-to-end in v0.2. Perplexity, Copilot, and DeepSeek have coded support; verification in progress. | Chrome extension (content script, isolated world) |
| Process / filesystem / network | Agent process lifecycle, files read or written, outbound connections, CPU and memory | psutil + watchdog / FSEvents |
The capture is selective: the proxy's --allow-hosts regex only intercepts AI API endpoints. Banking, email, and unrelated traffic flow through untouched.
Honest per-surface coverage (v0.2.1)
v0.2.1 captures comprehensively for Claude Code CLI, browser-based AI, and local models. Desktop AI apps have documented per-surface limits due to per-app proxy honoring on macOS. ai-monitor --status reports the honest live capture state per surface. The v0.3 architecture (Apple Network Extension framework) captures at the OS network stack level, closing all of these gaps.
| Surface | Coverage | Detail |
|---|---|---|
| Claude Code CLI | Full | JSONL session log + HTTPS proxy. Nothing missing. |
| Browser AI (claude.ai, chatgpt.com, gemini.google.com) | Full | Chrome extension DOM scrape. Other browsers (Firefox/Safari/Arc) not yet supported. |
| Ollama / local models | Full | Process scanner + network monitor. No HTTPS to intercept. |
| Claude Desktop | Partial | Main process maintains a persistent IPv6 channel to api.anthropic.com that bypasses the macOS IPv4 system proxy. Auxiliary connections (polling, telemetry, OAuth) reach the proxy; the chat-completion stream does not. Workaround: open the same conversation on claude.ai in Chrome — the extension captures it. Closed architecturally in v0.3. |
| ChatGPT Desktop | Envelope only | chatgpt.com is intentionally excluded from selective TLS inspection (the v0.2 API-only allow_hosts invariant). Connection envelope captured; content not decrypted. Workaround: use chatgpt.com in Chrome. Closed in v0.3. |
| Cursor | Partial | Plugin / extension-host subprocesses bypass system proxy at the Cursor vendor level. IDE-level API calls captured when present; helper traffic not. Closed in v0.3. |
Why the HTTPS proxy hits a ceiling on macOS desktop AI apps: macOS's HTTPSProxy is configured at a single IPv4 host. Electron-based apps maintain persistent IPv6 channels for chat completion that bypass this proxy and cannot be redirected by PAC after the connection is established. v0.3 uses Apple's Network Extension framework to capture at the OS network stack level, where routing-layer bypasses don't apply.
Two layers. Run both.
Static scanners inventory what's declared in your manifest and check it against known-bad lists. Vigil watches what the agent actually does at runtime. They cover different moments — the TanStack attack is exactly why you want both.
Static scanners
- WhenAt the manifest, before / around install
- SeesWhat's declared in the lockfile vs known-bad lists
- CatchesKnown CVEs & flagged packages already on a list
- Blind spotNovel behavior; anything that passes provenance but acts maliciously at runtime
Vigil
- WhenAs the agent acts, in the moment
- SeesThe actual install command, network call, and file write the agent runs
- CatchesBehavior — whether or not the IOC is on a list yet
- Blind spotRisk in code that never executes on your machine
Vigil flags the install command itself.
When an agent runs pip install or npm install, Vigil parses the command as it happens — resolving package, version, and source — and checks it against typosquat dictionaries and threat-intel feeds beforeyou depend on a clean IOC database. Each install is tied to the exact agent, session, and turn that ran it, so “how did this get on my machine?” has a one-click answer.
Free and open source.
macOS today (Sequoia 15 and 26.5 verified). Linux best-effort. Windows planned for v0.3.
# macOS
git clone https://github.com/rajan-cforge/ai-runtime-monitor-enterprise.git vigil
cd vigil && git checkout v0.2.1
python3.12 -m venv .venv
source .venv/bin/activate
pip install -e .
ai-monitor --setup
ai-monitor --start --with-proxyThe setup wizard generates a local CA, prompts you to paste one sudo command in a new terminal tab to trust it (the wizard is blocked on its own stdin while polling), and walks you through loading the Chrome extension. Full install takes about 5 minutes.
Requires macOS 12+, Python 3.12+, Chrome, and brief terminal sudo access. PyPI / pipx install path is planned for v0.3.
Then open http://localhost:9081. The CA is cryptographically constrained to AI domains only via X.509 NameConstraints — even if the CA key is compromised, it cannot be used to MITM banking or email; the OS validator enforces the constraint.
What's shipped, what's next.
v0.2.1 shipped 2026-06-03 as an honest interim release. Here's exactly what works today, what's in flight for v0.2.2 dashboard polish, and what the v0.3 architectural pivot to Apple's Network Extension framework will deliver — including the parts we haven't built.
Shipped · v0.2.1
- macOS (Sequoia 15 & 26)
- Claude Code CLI capture (JSONL + HTTPS proxy)
- Browser AI capture (claude.ai, chatgpt.com, gemini.google.com)
- Ollama / local model observation
- Selective SSL inspection + NameConstraints CA
- Honest --status capture matrix (live per-app verdicts)
- Credential leak detection (15+ patterns)
- Install-command parsing + typosquat detection
- URLhaus & ThreatFox threat intel
- 30-day local auto-purge
Coming · v0.2.2
- Dashboard polish — honest matrix as graphical UI
- Fill-rate metric surfaced in dashboard (the 13% → 82% trajectory)
- Recency indicators on session views
- Browser extension match-rate diagnostic + selector refresh
- Proxy-state restore file (clean uninstall)
Coming · v0.3
- Comprehensive desktop AI app capture via Apple Network Extension framework
- Signed .pkg + system-extension distribution
- Privileged macOS helper (no sudo paste)
- PyPI / pipx install path
- MCP server config scanning
- Prompt-injection detection
- Browser AI: verify Perplexity, Copilot, DeepSeek
- Cost computation for non-Anthropic models
- Linux + Windows support (eBPF / WFP equivalents)
Longer term
- Fleet-scale control plane — aggregate many developer machines into a shared dashboard
- A Pro / Enterprise offering — not yet defined, not yet committed
Vigil is open source and Apache 2.0 licensed— free for any use, individual or commercial, with no feature gates. v0.2 runs on a single developer's machine; the full HTTPS proxy capture, dashboard, and supply chain monitoring are all in the open-source release.
Fleet-scale monitoring — a control plane that aggregates from many developer machines into a shared dashboard — is the direction we're heading for organizations that want team-wide visibility. We're talking to security teams who might want to shape that work as design partners. If you're running AI coding agents at scale and would consider piloting something pre-1.0, reach out at hello@gocloudforge.com.
We're not selling anything yet.