Sentinel-class monitor · for AI agents
Proof of what your AI actually did.
Your agents write files, run commands and reach the network all day. Siphrix records every action from outside the agent — across your terminal, your editor and your browser, on one account — into a chain where removing a single entry breaks every hash after it. It never blocks, so it installs in a day.
Copilot · coding agents
Observability shows you a claim. Siphrix gives you evidence.
Tracing tools ask the agent to report on itself. When an agent is compromised — prompt injection, a hijacked tool call, or simply a bug — the trace describing its behaviour is written by the very code that misbehaved. A self-reported trace is a claim. Siphrix records from outside the agent, where the action is about to happen.
Recorded from outside
Siphrix hooks the agent's harness, so the record never depends on the agent being honest, correct or uncompromised. It sees the action — not the agent's account of it.
A chain, not a log
Every entry carries a SHA-256 over its own fields and the hash before it. Remove one entry and every hash after it stops matching. One click re-walks the chain and says so.
Proof someone else can check
Send an auditor a signed, expiring link. They open it with no account and see the attestation — never your files, never your commands. Revoke every link instantly.
One account, every surface
Terminal, VS Code and browser report into the same record. Coding agents, ChatGPT, Claude and Gemini — one place that knows what all of them did.
The auditor's language
The report names the controls it serves: ISO/IEC 42001 A.6.2.8 — recording of event logs — plus A.6.2.6 and SOC 2 CC7.2. Evidence you can file, not a screenshot.
It never blocks
An observer must not break the thing it observes. Nothing is stopped by default — which is why Siphrix goes in during a sprint, not a procurement cycle.
Your AI already acts in your name. Nobody is watching.
Every tool you connect can touch files, reach the internet and move money. Siphrix is the page you check afterwards — and the alarm that fires before you have to.
It deletes files
One misread instruction and a folder is gone — and without a record, you can't say which agent did it, or when, or why.
■ SEVERITY: CRITICALIt leaks data
A pasted secret, an uploaded document, a message to the wrong place. Siphrix knows the shape of a leak and writes the warning instantly.
▲ SEVERITY: HIGHIt spends money
Payments, subscriptions, purchases — agents can do all of it. Every attempt becomes an entry; the dangerous ones rise to the top.
■ SEVERITY: CRITICALConnect once. The record writes itself.
Link
One click for browsers and editors, one line for coding agents. Siphrix runs beside your tools — never in front of them.
$ siphrix agent-setup # linked.
Record
Files touched, commands run, sites reached, data shared — each becomes one clean, private entry. Metadata only. Never content.
✓ 09:42 http_request · recorded
Alert
Anything dangerous-looking is flagged by severity, with the reason in plain language — the moment it happens.
■ CRIT shell_command · rm -rf
Watch the sentinel work.
A simulated session, playing itself — exactly what your console shows while your agents run. No interaction required. Nothing here is executed.
THREAT INDEX
“An observer must never break the thing it observes. Siphrix watches everything — and touches nothing.”
Everything a record should be.
Complete
Every decision from every connected surface — browsers, editors, agents on each machine. One timeline, exportable.
Ranked by severity
Critical first, low last. Secret-shaped pastes, destructive commands, data egress — flagged the moment they're written.
Readable
Plain language on the surface, verdicts and reason codes underneath — for the day you need to know exactly what happened.
Loud where you live
One webhook forwards warnings to Slack, PagerDuty or your SIEM. Mute noisy rules; bursts escalate on their own.
Private by construction
Runs on your machine. Metadata only — action, app, verdict, time. Never file contents, never message text.
Enforcing, if you insist
Watching is the default. An opt-in enforcement mode can turn any flag into a hard stop — off until you say otherwise.
Your coding agent, on the record.
Claude Code, Codex and MCP-speaking agents link with one command. Every tool call is evaluated and written down before it runs — the audit trail builds itself while you work.
- Record-only by default — an observer must never break the thing it observes
- A real policy engine underneath: verdicts, reason codes, decision ids
- MIT-licensed core · fully offline · a JSON log you own
Fair questions, straight answers.
Do I need to be technical?
No. Siphrix senses your surfaces on its own — you just set how closely each one is watched: Dormant, Standard or Vigilant, in plain words. The technical detail exists underneath for those who want it, and stays out of the way for those who don't.
What happens when something risky is spotted?
It's written down instantly and lands in your Warnings, ranked by severity, with the reason in plain language. Forward it to Slack, PagerDuty or a SIEM if you like. The action itself is not stopped — you stay in charge.
Can it actually block things?
Yes — as an explicit opt-in. Enforcement mode turns flags into hard stops, for those who want prevention rather than a record. It ships off, because a sentinel that quietly interferes with your work is not a sentinel you can trust.
Will it slow down or break my tools?
No. The record is written beside your tools, not in front of them. Even if Siphrix itself fails, your workflow continues untouched — that is a design rule, not a promise.
Where does my data go?
Nowhere, unless you say so. The log lives on your machine as metadata only — action, app, verdict, time. The optional cloud console syncs those same safe entries across your devices. Content never leaves.
Initialize the record.
One minute from now, everything your AI does can be on the page.
Open your console — free