Audit

tracekit audit

tracekit audit is a read-only command that replays the tool calls found in local coding-agent transcripts through the policy engine and reports what the current policy would have held or denied. Each call is decided as the signer decides it: an MCP tool (mcp__<server>__<tool>) also as mcp:<server>/<tool> and under its bare name, and a PowerShell command also as a shell line.

It does not start a signer, does not write anything, and does not make network calls. It is a replay against today's policy, not a signed record. Tracekit never recorded these calls, so nothing here is evidence.

It is experimental (support): it works and is tested, but may change.

Usage

tracekit audit [ROOT] [--policy PATH] [--since 7d] [--show] [--all] [--json | --share]

$ tracekit audit --since 7d --show
a replay against today's policy, not a signed record
policy: …/tracekit/policy2/packs/dev.yaml (sha256:…)

1204 tool calls in 31 sessions since 7d: Tracekit would have denied 2 and held 9 for a person; it would have flagged 57 and allowed 1136.
…
by rule:
  TK-F003: 41  (destructive)
  TK-A002: 3  (deleting a remote Git ref)
  TK-D004: 1  (recursive delete of root or home)
…
denied and held calls (--all for every call):
  4f1c…  2026-10-28T14:02:11+00:00  Bash  deny  rules=TK-D004,TK-F003  text='Bash rm -rf ~/'

(The numbers above are an example, not a measurement.)

• ROOT defaults to $CLAUDE_CONFIG_DIR/projects when CLAUDE_CONFIG_DIR is set (Claude Code keeps its config there then), else ~/.claude/projects; a folder that doesn't exist is an error (exit 2).
• --policy selects a policy file (default: the dev pack, tracekit/policy2/packs/dev.yaml).
• --since limits the replay (e.g. 7d, 24h, 30m, or an ISO-8601 time, UTC unless it gives an offset); a call without a timestamp is kept. A --since that isn't in the past, or that no date can name, exits 2.
• --show includes each call as an approver sees it: its secrets redacted as the signer redacts them (.env content too), cut to 72 characters.
• --all lists every call; without it, only the calls Tracekit would have denied or held for a person.
• --json emits a machine-readable report, with every call.
• --share prints the counts alone, to post as a field report: the window's length, the number of sessions, the calls by decision, and each rule by the decision of the calls it matched, marked also matched, not why when the rule's section isn't that decision and not placed for an engine check. A rule id that isn't Tracekit's own is counted as custom rule. No session, path, time, call or rule description.

The report always begins with the disclaimer: "a replay against today's policy, not a signed record".

What it reads

Every .jsonl file under ROOT, at any depth: each Claude Code session's transcript, and its subagents' files (<session>/subagents/*.jsonl, a workflow's agents' in <session>/subagents/workflows/<workflow>/), which count under that session. Each line is a JSON object; assistant messages may contain tool_use blocks. A tool use whose id was read already (a resumed or forked session's file repeats the calls it copied) counts once. The reader reuses tracekit.hook.transcript_entries and the policy engine from tracekit.policy2.engine.

It follows no symlink. Files and folders it can't read are counted and skipped, and so is a line that isn't JSON.

Output

• One line first: how many calls in how many sessions, and how many Tracekit would have denied, held, flagged and allowed.
• Counts per verdict (deny, ask / held, flag, allow). A call the policy engine fails on counts as a deny (TK-ENGINE-ERROR), as the signer would decide it.
• Counts per rule id, most first, each with what the rule is (its reason or label, or the viewer's words for the engine's own rules).
• The session and timestamp of each denied or held call (every call with --all), and its redacted text with --show.

Limitations

It sees only the tool calls the transcript holds, decided by today's policy. A transcript the agent could edit is not evidence. See limits.