v0.9.0: Claude Code Wrapped

scan --wrapped writes one shareable card (sessions, tool calls, busiest hour, how often your agent would have needed a human). Numbers only: no commands, file names or project names. Local, read-only, nothing uploaded. 152 tests.

v0.8.1: fewer false alarms, found on other people's runs

Rules checked on a random sample of 2,000 public agent runs (121,219 actions). 14 false alarms found and fixed. Method, numbers and limits: docs/VALIDATION-PUBLIC-RUNS.md. 147 tests.

v0.8.0: rules that fit you, and a live hook (experimental)

Rules that fit you, and a live hook (experimental).

New

• scan --write-rules my-rules.json: writes a copy of the starter pack in which the kinds of action that do not appear in your history (the agent never force-pushed, never read a secret file, never destroyed cloud resources) get a first deny rule, and the kinds you use keep the starter rules. Needs 200 judged actions, otherwise it locks nothing and says so. A proposal in a file: nothing is blocked by it.
• python -m agentdryrun hook (experimental): the same rules applied live as a Claude Code PreToolUse hook. Refused: the call is blocked with the reason. Needs approval: you are asked. Would pass: no output, so Claude Code's normal permission flow decides (it never answers "allow"). --mode observe --log hook-log.jsonl judges and logs without blocking: start there. --print-settings prints the settings.json block.

What was checked

• 142 tests, CI green on Python 3.9/3.11/3.12, Node 18/22 and the MCP SDKs.
• --write-rules run on a real 90-day history: 7 kinds locked, 6 kept, the same verdicts as the pack on that history (as it must be).
• The hook: its protocol was read from Claude Code's hooks documentation and exercised with simulated calls (deny, ask, no output, observe, bad input, non-ASCII). A test found a real bug: JSON printed through a Windows console code page could become unparseable (which fails open); the output is now ASCII-escaped.

What was NOT checked

• The hook has not been run inside a live Claude Code session. A hook that crashes or times out lets the call through unless you set "onFailure": "block" (needs a recent Claude Code).
• Pattern matching: it misses scripts and paths built at run time, and flags a few harmless things. Claude Code only. Not a sandbox.
• The package is not on PyPI yet (the publish workflow is ready and switched off until the owner configures PyPI).

v0.7.1: install it from inside Claude Code (/agentdryrun:scan)

Install it from inside Claude Code.

claude plugin marketplace add ntinosgkiou-code/agentdryrun
claude plugin install agentdryrun@agentdryrun

then type /agentdryrun:scan (optionally --days 90). It runs the same read-only, local scan as python -m agentdryrun scan, and writes a report card without command text. Only you can start it (the skill is marked so Claude cannot run it on its own). Python 3.9+ must be on the machine; nothing else is installed.

Checked: claude plugin validate --strict; installed from this GitHub address into a throwaway Claude Code config; the scan command run from the installed copy; 119 tests, CI green.
Not checked: running the skill inside a live Claude Code session, the Windows PowerShell form of the command, and the plugin on claude.ai or Cowork (it needs a local Python). Tell us if it misbehaves.

v0.7.0: scan, a dry run on your own coding agent's history

scan: a dry run on your own coding agent's history.

git clone https://github.com/ntinosgkiou-code/agentdryrun && cd agentdryrun && python -m agentdryrun scan

It reads the Claude Code transcripts on your machine (~/.claude/projects, last 30 days), names what the agent attempted, judges each action against a starter rules pack, and writes one HTML report card: what would pass, what would need approval, what would be refused, and where the tool output piled up. Read-only, local, nothing is sent anywhere. Use --no-previews before you share the page.

• Starter rules: agentdryrun/packs/coding-agent.json (copy it, edit it, pass --rules). --events-out writes the derived events for shadow; --max-refused / --max-pending exit 4 for CI.
• Tuned on a real 90-day history to remove false alarms (here-documents, quoted text, cd and variables set earlier in the command, curl | python -c, filtered find -delete). Invented sample: python -m agentdryrun scan --root examples/claude-code-sample/projects --days 0; sample report card.
• 114 tests. CI green on Python 3.9/3.11/3.12 and Node 18/22.

What it is not: pattern matching on commands, so it misses scripts and run-time paths and flags a few harmless things; it cannot know whether a command worked or whether you approved it; Claude Code only (the transcript format is not a documented interface and was read as it looked on 2026-10-25); not a sandbox, a certification or a security audit. Prototype, no external review.

v0.6.0: MCP recorder, rules drafter, JavaScript recorder

Three ways to get to your first report with fewer steps. Prototype, no external security review; read the known limits.

New

• mcp-record: a stdio proxy in front of any MCP server. It forwards every message unchanged and copies each tools/call into an events file before the server sees it. No change to your agent or the server.
  python -m agentdryrun mcp-record --out mcp-events.jsonl -- python my_server.py
• suggest-rules: drafts a first rules file from what your agent did (from tool names only; every entry says REVIEW ME; it never writes limits or refusals).
• JavaScript/TypeScript recorder (js/): same Recorder, same events file, zero dependencies, Node 18+. npm install github:ntinosgkiou-code/agentdryrun (not on npm yet).

What was checked

• Byte-for-byte transparency of the proxy against a fake server; the official MCP Python SDK 1.30 and 2.3 (client and server) in CI on Linux and Windows, both calls recorded.
• Node recorder on Node 18 and 22, Linux and Windows. Events written by JavaScript are judged by the Python side.
• 92 Python tests, 7 Node tests.
• A real bug found only by using the official client: the proxy crashed when the server exited while the client still held stdin open. Fixed and pinned by a test.

What was NOT checked

Desktop MCP clients (Claude Desktop, Cursor, VS Code), servers in other languages, the HTTP transport. If yours misbehaves, open an issue with the client name and version.

It records the attempt, not the result or the approval, and it cannot stop anything. See the README.

v0.5.0: agentdryrun (renamed), GitHub Action, Recorder, hardened verifier

agentdryrun is a dry run for AI agents. Record what an agent's tools did, see what your rules would have blocked or sent for approval, and keep a record nobody can quietly edit. Local, standard library only, nothing is sent anywhere.

What is new in 0.5.0

• New name. The project was called OmniOS, which is also an unrelated operating system. It is now agentdryrun. The old repository URL redirects. The evidence-bundle format identifier omnios-evidence-bundle is kept on purpose so existing signed bundles keep verifying.
• GitHub Action. Run the dry run on every pull request and fail the build when more actions would be refused, would need approval, or use a tool no rule covers than you accept. It writes a job summary table, uploads the HTML report and exits with code 4 over a limit. Tested in this repository's own CI on Linux and Windows, including the case where it must fail.

- uses: ntinosgkiou-code/agentdryrun@v0.5.0
  with:
    rules: rules.json
    events: tests/agent-events.jsonl
    max-refused: 0
    max-unmapped: 0

• New flags: shadow --max-refused / --max-pending / --max-unmapped / --summary-md.
• README leads with the problem, badges, and the same one-command demo.

Already in the last releases

• Recorder: two lines around your agent's tool functions write what it does to a local file (@rec.tool("payments.send")). Keeps only the fields your rules look at; never breaks your agent.
• Readers for Langfuse, LangSmith and OpenTelemetry exports (field names checked against the primary sources; not yet run on real exports).
• A verifier that was attacked and fixed: 76 hostile bundles; the one real hole (records omitted under a relabelled scope) is closed (INCOMPLETE warning, --require-all).
• pip install git+https://github.com/ntinosgkiou-code/agentdryrun, python -m agentdryrun demo, 74 tests on Python 3.9, 3.11 and 3.12.

What it is not

A prototype with no external security review. It does not certify anything, does not make you compliant with any regulation, and does not stop prompt injection. The recorder logs attempts, not outcomes or approvals. The example data is invented. Read docs/KNOWN-LIMITS.md.

Help wanted

The most useful things you can do: try the readers on a real export and send a redacted sample if it fails; try to break the verifier; pick a good first issue.