DEV Community

mukesh Kumar
mukesh Kumar

Posted on AI-assisted

My AI agent built a flight recorder for AI agents, and it flagged itself

#agents #ai #security #softwaredevelopment

Every developer I know now runs an AI coding agent in something like auto-accept mode. Claude Code, Codex, Cursor: you give it a task, it runs commands, edits files, installs packages, and you review... the diff, maybe. The commands? The installs? The thing it did in that folder outside the repo? Nobody looks. The activity scrolls off the terminal and is gone.

Tracon demo: the Overview dashboard, the Live security room wall with a flagged monitor, and the conversation behind a flagged command

That asymmetry bothered me. We built an entire industry around audit trails for humans (git blame, CI logs, access logs), then handed the keyboard to agents and kept none for them.

So I built Tracon: a local flight recorder for AI coding agents. The name is the FAA's term for Terminal Radar Approach Control, the radar room that tracks every aircraft in an airspace. This one tracks every agent on your machine.

What it does

Tracon is a Mac and Windows desktop app (Tauri 2, Rust core, React UI, SQLite store) that sits in the tray and records what your agents do:

  • A timeline per session: every command, file edit, package install, and prompt, attributed to the agent and session that did it
  • Danger flags as they happen: recursive deletes, pipe to shell installs, credential access, force pushes, permission bypasses. Tracon flags; it never blocks
  • A Live page: one monitor per active session, like a security room, streaming recent commands with flagged ones highlighted in red, plus which subagents the session has spawned
  • A conversation reader: the actual chat behind any event, read straight from the agent's own transcript, read only
  • A package watch across npm, pnpm, pip, cargo, and brew, with opt in threat intelligence against osv.dev

Capture is deliberately passive. Hooks give real time events over localhost; transcript tailing (filesystem notify, read only) covers everything else, so CLI sessions show up live even with zero setup. A dead or closed Tracon never slows an agent down. Everything stays on your machine: no telemetry, no accounts, AGPL.

The recursive part

Here is the part I find genuinely funny: Tracon was largely written by Claude Code, with me directing, reviewing, and vetoing. And because Tracon tails Claude Code transcripts, it recorded its own construction.

At one point the agent ran rm -rf node_modules to fix a dependency issue. Tracon, half built, flagged it: recursive delete, red pill, straight into the flag inbox. The first real data on the Live page was the session that was building the Live page. When I later ran an eight angle automated review before the v0.2.0 release, the review agents found a bug where the live board picked a session's working directory by lexicographic MAX instead of most recent. The commit fixing it is in the history, next to the EXPLAIN QUERY PLAN output proving the query it optimized.

I decided to say all of this out loud in the README instead of hiding it, for one simple reason: an auditor you cannot audit is spyware. A tool whose pitch is "you should be able to review what agents do" cannot be shy about having been written by one. The transparency is the trust model.

What building with an agent actually required

The vibe coding meme undersells how much human judgment this took. A few honest notes from the log:

  • The agent shipped a UI that froze for seconds at a time. The cause: every Tauri command ran on the app's main thread, fine at 100 events, fatal at 72,000. The fix (async commands on a blocking pool plus a read only SQLite connection pool) came from profiling a real 283MB database, not from vibes.
  • Design took many rounds of human taste. I rejected three logo directions before landing on the current mark, killed the gradients (they read cheap), and made it flatten everything.
  • The pre-release review mattered. Eight independent review passes over the last feature found ten real issues, four of them correctness bugs that had survived manual testing. All fixed before tagging.

If you want to see what agent written, human directed, machine audited software looks like, the repo is the receipt.

Try it

Installers for macOS (Apple Silicon and Intel) and Windows are on the releases page. Run any Claude Code or Codex session and it appears in the timeline within seconds; add the hooks for real time capture.

https://github.com/mukes555/tracon

If your agents are doing something Tracon should flag and does not, that is exactly the issue I want filed.

Top comments (0)