Support

What's stable

Tracekit has a small stable core and a larger set of experimental surfaces. Both ship in the same package.

Stable means it is tested end to end on every push to main and every pull request, and hardened first.

Experimental means it works and is tested, but it may change between releases and gets less hardening. Each experimental command or server prints one line to stderr when it starts. Anything not listed as stable is experimental.

Stable core

Surface	What it covers
v2 signer, dev mode	tracekit.instrument(), tracekit up/down/last, tracekit signer serve --dev, file storage
v2 signer, system mode on Linux	sudo tracekit init --v2 --user AGENT: the signer as its own OS user, file storage, uid and token callers
Python SDK	tracekit.sdk (RunHandle) and tracekit.instrument()
Framework integrations	OpenAI Agents SDK, LangChain / LangGraph, Claude Agent SDK, MCP client wrapping: each runs the adapter contract against the pinned real library on every push to main and every pull request
Claude Code hooks (v2)	tracekit init --dev --v2 and system mode's hooks
Policy v2	the engine, tracekit policy compile/lint, the shipped packs (tracekit/policy2/packs/), ask approvals from the command line (tracekit approvals)
Bundles	tracekit export --v2, evidence format v2
Verifiers	tracekit verify (v2, and v1 bundles with the frozen v1 verifier) and the TypeScript verifier (sdk/typescript/src/verify/)
tracekit view	the laptop viewer
tracekit doctor	setup checks

Experimental

Surface	Docs
tracekit why: investigation, replay, signed findings	why
Detection and containment: sequences and limits, holds, quarantine, suspensions, incidents, the webhook outbox	incidents, webhooks
Argument provenance (untrusted, from_untrusted)	policy
Readable reasoning: what the model said, recorded by the transcript tailer, the coding-agent hooks, the framework integrations and the LLM gateway	reasoning
Live constraints: a limit the person's prompt states ("don't touch billing.py") held by the signer for the rest of the run (its grammar is tested against E20's phrase sets)	policy
Agent approvers, the reference reviewer (tracekit reviewer), Slack approvals, passkey (WebAuthn) approvals	approvals
The signer's HTTPS transport and its OIDC, Kubernetes service-account and mTLS identities	identity, remote clients
Postgres storage and multi-tenant signers	deployment
LLM gateway, tool executor, MCP gateway, egress observer	gateway, executor, MCP gateway, egress
The egress observer's SOCKS5 listener for E2B's and microsandbox's outbound proxies (tested against E2B's API description and microsandbox's source, not either running)	E2B, microsandbox
agentgateway: the ext_mcp processor (tracekit ext-mcp) and the import of its MCP spans (tested against the protocol and span attributes in agentgateway's source, not a running agentgateway)	agentgateway
Wassette behind the MCP gateway (its policy rule is tested against a stand-in with Wassette's tool names, not against Wassette in CI)	Wassette
tracekit follow (agentsh's audit log) and the signer's importers	agentsh
Verified tool results (signer.yaml verify_tool_results)	gateway
The kernel sensor import (tracekit sensor import), Linux: checked against event lines shaped as Tetragon's and Falco's source writes them, not a live sensor	Tetragon, Falco
OTLP import and export, the v1 OTLP receiver, ingest gateway and model proxy (these three need --experimental)	OpenTelemetry
Witnesses, the public witness, Rekor and RFC 3161 anchors, tracekit monitor, the record-key issuer, external and KMS log keys, SLH-DSA hybrid checkpoints	witnesses, monitor, issuer
Cost, usage, coverage and findings (tracekit cost, tracekit analyze), and the intent, reasoning and action checks of v2 runs (tracekit analyze --v2, signed into a findings run with review_finding; --review, a reviewer model)	findings
Container image, Helm chart, compose stack (tracekit deploy compose)	compose, Kubernetes, container
The signer outside a Kubernetes agent-sandbox Sandbox (tested end to end on a kind cluster with agent-sandbox v1.0.7; not with a gVisor or Kata RuntimeClass)	agent-sandbox
System mode on macOS (--experimental-macos)	platforms
Harness binding and the transcript tailer	quickstart
The Claude Code plugin (plugin/): the v2 Claude Code hooks through Claude Code's plugin system (its hook script is tested against the dev signer; loading inside a live Claude Code isn't)	plugin
The sandbox-runtime decider (tracekit srt-decider; tested against a stand-in that speaks srt-proxy's decider protocol, not a released srt-proxy)	sandbox-runtime
Codex CLI, Cursor and Gemini CLI hooks (checked against recorded hook payloads, not the live tools)	coding agents
CrewAI (tested against a stand-in, not the real library) and Browser Use (its real-library contract runs nightly only)	CrewAI, Browser Use
Pydantic AI (tested against the real library; not yet run through tests/adapter_contract.py)	Pydantic AI
Google ADK (tested against the real library; not yet run through tests/adapter_contract.py)	Google ADK
Haystack (tested against the real library; not yet run through tests/adapter_contract.py)	Haystack
LlamaIndex agents: FunctionAgent, ReActAgent, CodeActAgent, AgentWorkflow (tested against the real library; not yet run through tests/adapter_contract.py)	LlamaIndex
Microsoft Agent Framework (tested against the real library with a scripted chat client; not yet run through tests/adapter_contract.py; its MCP tools need mcp 1.x)	Microsoft Agent Framework
Strands Agents (tested against the real library in a CI job of its own, as strands-agents needs mcp below 2.2; not yet run through tests/adapter_contract.py)	Strands Agents
The NVIDIA OpenShell supervisor middleware, tracekit openshell-middleware (tested with a gRPC client playing OpenShell's supervisor, not a live OpenShell)	OpenShell
The import of OpenShell's OCSF events into each sandbox's run (tested with log batches built as OpenShell's exporter writes them, not a live OpenShell)	OpenShell
The LiteLLM guardrail for LiteLLM's MCP gateway (tested against LiteLLM's guardrail interface as its source defines it, not a running proxy)	LiteLLM
Docker's MCP Gateway as an upstream of the MCP gateway (tested against a stand-in for docker mcp gateway run, not Docker's gateway itself)	Docker MCP Gateway
The TypeScript SDK client and its Vercel AI SDK integration (@cygnuxlabs/tracekit on npm)	TypeScript SDK, Vercel AI SDK
contrib/ packages	contrib
The v1 signer path: tracekitd, tracekit init without --v2, tracekit observe, v1 adapters. Verifying v1 bundles stays stable.	coding agents, signing