Repository navigation
Reasoning
In one line: Tracekit records what the model said before each tool call (its reasoning, its text, the call it asked for) wherever the agent, framework or provider hands it over, and this page says, for each one, how much of that reasoning you will be able to read and the one setting that makes it readable.
Tracekit always signs a commitment to what the model said. The text itself is kept only when the signer's
content vault is on (the dev signer keeps it for 7 days), so tracekit analyze --v2
(findings) and tracekit view can read it,
and erase it when retention ends.
What the columns mean:
-
Recorded:
fullis the model's own reasoning text (open models return it);summaryis the provider's summary of it (Claude, OpenAI's reasoning models and Gemini return summaries);encrypted onlymeans the provider returned the reasoning sealed (a signature,redacted_thinking,encrypted_content, athought_signature), which Tracekit keeps byte for byte but nobody can read today;nonemeans no reasoning reaches anything Tracekit sees. -
Linked means the record carries the id the call was decided under, so each action is checked against what was
said right before it. An unlinked record is still signed and readable; the checks report its calls as
unlinked. - Reasoning is the model's account of itself: self-reported, not proof. Text from a coding agent's transcript or hook
is written by the agent's own process, and the findings label it so (trust tier
transcript).
tracekit doctor says, for each agent whose hooks are installed, whether its reasoning will be readable, and prints
the fix (D-THINKING-SUMMARIES, D-CODEX-REASONING, D-GEMINI-THOUGHTS; doctor).
| Agent | Recorded | How to turn it on | Where it comes from | Linked |
|---|---|---|---|---|
| Claude Code | summary; encrypted only while summaries are off |
"showThinkingSummaries": true in its settings (tracekit init --v2 sets it); headless: claude -p --thinking-display summarized
|
its transcript, read by the transcript tailer | yes, by tool_use_id
|
| Codex CLI | summary, and the encrypted_content; encrypted only while summaries are off |
model_reasoning_summary = "auto" in ~/.codex/config.toml (tracekit init --v2 --agent codex sets it; Codex's current models default to none) |
its rollout file, read at each hook | yes, by call_id
|
| Gemini CLI | summary (its thought summaries) | on by default; don't set includeThoughts: false in modelConfigs
|
its chat recording, read at each hook | no: Gemini CLI gives a call no id, and writes the thoughts after the calls run |
| Cursor | the thinking text Cursor reports (recorded as a summary) | nothing: tracekit init --v2 --agent cursor installs its afterAgentThought and afterAgentResponse hooks |
those hooks | no: they carry no call id |
Gemini CLI's and Cursor's messages are recorded said_only: what the model said, without the calls it asked for, which
their hooks can't name. The signer reconciles no call against them, so an honest session never reads as one whose calls
no model asked for (reconcile.fabricated); it also gets no such cross-check.
| Framework | Recorded | How to turn it on | Where it comes from | Linked |
|---|---|---|---|---|
| OpenAI Agents SDK | summary, and encrypted_content, as the Responses API returns them |
ask the model for summaries: ModelSettings(reasoning=Reasoning(summary="auto"))
|
the integration (hooks=tk, each model response) |
yes, by call_id
|
| Claude Agent SDK | summary, and the thinking's signature |
thinking={"type": "adaptive", "display": "summarized"} (Opus 4.7 and later omit the text by default) |
the integration: hand each message to tracekit_said
|
yes, by tool_use_id
|
LangChain / LangGraph create_agent
|
summary (reasoning blocks, with their signature or encrypted content); full for an open model's reasoning_content or inline <think>
|
the model's own reasoning settings | the middleware (each model call) | yes, by tool call id |
LangGraph with tracekit_tool_node
|
none from the integration | use tracekit.instrument() or the LLM gateway |
- | - |
| Pydantic AI | summary (ThinkingPart), and its signature |
the model's own thinking settings | the capability (each model response; an output function's call or an approved tool's is added to its response when it is decided) | yes, by tool_call_id
|
| Google ADK | summary (thought parts), and each thought_signature
|
include_thoughts=True in the agent's thinking config |
the plugin (each model response event) | yes, by ADK's call ids |
| Strands Agents | summary (reasoningContent), and its signature or redacted content |
the model provider's reasoning settings | the hook provider (each model message) | yes, by toolUseId
|
| Haystack | summary (the message's reasoning), and OpenAI's encrypted_content
|
the chat generator's reasoning settings | the before_tool hook |
yes, by the call id (one Tracekit gives a call that has none) |
| LlamaIndex | summary (ThinkingBlock) |
the LLM's thinking settings | the gate (each agent output) | yes where the model names the call; otherwise paired by arguments only |
| Microsoft Agent Framework | summary (text_reasoning), and its protected_data
|
add tk.chat to middleware= beside tk
|
the chat middleware (each model response) | yes, by call_id
|
| CrewAI | none from the integration | use tracekit.instrument() or the LLM gateway |
- | no: CrewAI's tool hooks carry no call id |
| Browser Use | none from the integration | use tracekit.instrument() or the LLM gateway |
- | no: an action has no model call id |
| Vercel AI SDK (TypeScript) | a commitment to the response, reasoning parts included; not readable | use the LLM gateway for readable reasoning | the middleware | yes, by toolCallId
|
Through the LLM gateway, which records the provider's response before the agent gets it, or
tracekit.instrument() in the agent's process. The gateway can also ask the provider for readable
reasoning.
| Provider | Recorded | How to turn it on |
|---|---|---|
| Anthropic (Claude) | summary, and each thinking block's signature; encrypted only with display omitted
|
thinking display: "summarized" (Opus 4.7 and later default to omitted) |
| OpenAI Responses (o-series, GPT-5) | summary; encrypted only with encrypted_content alone |
reasoning.summary: "auto"; for the sealed form too, include: ["reasoning.encrypted_content"]
|
| OpenAI Chat Completions (reasoning models) | none: the API returns no reasoning, only its token count | use the Responses API |
| OpenAI-compatible open models (vLLM, Ollama, OpenRouter) | full: reasoning_content, reasoning, or inline <think>
|
the server's reasoning parser, or nothing (inline) |
| Google Gemini | summary (thought parts); encrypted only (thought_signature) without them |
thinking_config: {include_thoughts: true} |
| DeepSeek, Qwen, gpt-oss | full | nothing: they return their reasoning |
- What stays unreadable, and why: limits.
- How the text is kept, encrypted, read and erased: privacy.
- Each integration's page says what it records: integrations.
Generated from docs/ at v1.4.1. Edit the docs in the repository, not here.
Get started
- Quickstart: the v2 signer
- Quickstarts
- Quickstart: Claude Agent SDK
- Quickstart: a custom agent
- Quickstart: LangChain and LangGraph
- Quickstart: MCP client
- Quickstart: OpenAI Agents SDK
- Coding agents other than Claude Code
- tracekit doctor
- Walkthrough: Tracekit end to end
How it works
- How Tracekit works
- Overview
- The life of a tool call
- The evidence format
- Verification and assurance
- Witnesses and monitoring
- Policy
- Approvals
- Detection and containment
- Capture and completeness
- Custody
- Provenance and tracekit why
- Deployment and isolation
- Storage, durability and performance
- Integrations
- Security model
- Architecture
- tracekit why: architecture
Integrations
- Integrations
- Adapters
- OpenTelemetry
- Remote clients
- Kubernetes agent-sandbox
- agentgateway
- agentsh and Tracekit
- Browser Use
- Claude Agent SDK
- Claude Code's sandbox
- Codex's sandbox
- CrewAI
- Docker MCP Gateway
- E2B
- Falco
- Gemini CLI's sandbox
- Google ADK
- Haystack
- LangChain v1
- LiteLLM
- LlamaIndex
- MCP client
- microsandbox
- Microsoft Agent Framework
- OpenAI Agents SDK
- NVIDIA OpenShell
- Pydantic AI
- sandbox-runtime's proxy on its own
- Strands Agents
- Tetragon
- Vercel AI SDK
- Wassette
Policy and approvals
- Policy reference
- Approvals
- Findings
- Reading the model's reasoning
- Incidents and containment
- Webhooks
Deploy and operate
- Deploying the signer
- The signer as a container
- The signer on Kubernetes
- The compose stack
- Identity
- Tool executor
- MCP gateway
- LLM gateway
- Egress observation
- Witnesses
- Log monitor
- Record-key issuer
- Signer observability
- Viewer
- tracekit why: causal investigation and replay
- Migrating
- Platforms
Verify the evidence
- Reading a v2 verify report
- Evidence format v2
- Auditor guide
- Sample evidence bundle
- Signing
- What Tracekit guarantees
Security and privacy
- Threat model: the v2 signer
- Threat model: the v1 laptop signer
- HTTP security checklist
- Threat-model review packet
- Privacy
- Known limits and trade-offs
- What's stable
Compliance
- Compliance mapping
- EU AI Act
- ISO/IEC 42001
- NIST AI RMF and the Generative AI Profile
- OWASP Top 10 lists for LLM and agentic applications
Evaluation
Demos
- Demos
- Agent approvers within bounds
- Completeness and tamper evidence
- Detection and containment
- Network coverage: an egress observer
- Guardrails: allow, deny, or ask a person
- MCP tools, gated and recorded
- Prompt injection held by provenance
- Why: which input caused the action
Help