TraceRookA second look before execution
Coding agents can edit files, execute commands, contact services, and read instructions from sources you did not author. TraceRook is designed to add an independent review layer that relates a proposed action to the task you actually asked the agent to perform.
The MVP2 architecture extends the native preview and combines deterministic local policy with Anthropic Claude for contextual analysis. It focuses on supported local Claude Code and Codex sessions on one Mac. A native menu bar companion keeps status visible; a SwiftUI dashboard explains findings and presents one-time reviews.
What you can try today
The current development milestone includes the native interface, deterministic Cloud Demo fixtures, sample incident evidence, and a sample approval experience. MVP2.0 adds strict IPC v2 contracts, exact invocation bindings, and helper codec self-tests while preserving v1 compatibility. The local suite has 43 passing tests.
Live hook ingestion, the background service transport, safe hook installation, actual enforcement, SQLite persistence, and direct Anthropic BYOK are pending. The app does not claim verified real protection. A polished sample screen is a demonstration of the interaction, not proof of interception.
Start with the native preview, then read the implementation status.
The intended decision model
| Risk | MVP1 response | Authority |
|---|---|---|
| Critical | Immediate denial with concrete local evidence | Enabled catastrophic deterministic rule |
| High | Pause for human review; expiry denies | Local evidence or contextual recommendation |
| Medium | Allow with warning and finding | Deduplicated advisory decision |
| Low | Allow with minimal event record | No TraceRook override of host permissions |
Claude can recommend review and identify drift. It cannot grant permissions or erase a deterministic critical denial. TraceRook Allow Once only releases its own gate; the coding agent’s native permissions still apply.
Know the boundary
TraceRook is a hook-based guardrail. It is not a system-wide sandbox or an endpoint detection platform. A hook that never runs cannot enforce a denial. An intercepted shell call can start nested processes that TraceRook does not separately mediate.
Remote sessions, hosted tool paths without local callbacks, arbitrary commands outside an integrated agent, and tampering by another process with the same user privileges are outside the complete guarantee. See coverage and failure behavior.
Platform and product scope
- Apple Silicon Mac with macOS 26 or later.
- Swift 6, SwiftUI, and the macOS 27 SDK for development.
- Individual developer, local hook-capable Claude Code and Codex sessions.
- Developer ID signed and notarized distribution is a release gate; the current source build is a development preview.
OpenCode, enterprise management, a real TraceRook Cloud backend, billing, and vulnerability scanning are deferred beyond MVP1.