agentdryrun

What did your coding agent actually do last month?

Anthropic reports that users accept 93% of Claude Code's manual permission prompts. One command reads the session history Claude Code already keeps on your machine and shows what your rules would have stopped: recursive deletes, force pushes to main, curl | sh, secret files read, files sent to other hosts, destructive database and cloud commands. Think terraform plan, but for what your agent did. Read-only, local, zero dependencies, nothing is sent anywhere.

See a sample report card GitHub Latest release

Terminal recording of agentdryrun scan on invented sample transcripts: 48 actions judged, 24 would pass, 19 would need approval, 5 would be refused, grouped by kind

The real output of one command on the invented sample in the repository.

Try it on your own history

git clone https://github.com/ntinosgkiou-code/agentdryrun && cd agentdryrun && python -m agentdryrun scan

Python 3.9 or newer. Nothing to install. Reads ~/.claude/projects (last 30 days) and writes agent-report-card.html. Use --no-previews before you share the page. Claude Code only, for now. Or inside Claude Code: claude plugin marketplace add ntinosgkiou-code/agentdryrun, then claude plugin install agentdryrun@agentdryrun and /agentdryrun:scan.

Share what it found

python -m agentdryrun scan --wrapped also writes Claude Code Wrapped: one card with your sessions, tool calls, busiest hour and how often your agent would have needed a human. Numbers only: no commands, file names or project names. You can save it as a PNG in your browser; nothing is uploaded.

Claude Code Wrapped card made from the invented sample transcripts

The card for the invented sample in the repository.

Checked on other people's data

The starter rules were run over a random sample of 2,000 public agent runs (121,219 actions). The check found 14 false alarms, now fixed; 35 flags remain, all inside disposable sandboxes, so this is not a measure of danger. Method, numbers and limits.

Under the scan: a dry-run engine for any agent

1. RecordTwo lines around your agent's tool functions (Python or JavaScript) write every call to a local file, before it runs. It never breaks your agent. Or put mcp-record in front of any MCP server and change nothing else.

@rec.tool("refunds.issue")
def issue_refund(customer, amount_eur): ...

2. Dry runA rules file says what may pass, what needs approval, what is refused. The report shows what would have happened, and which tools no rule covers. suggest-rules drafts the first rules file for you. Runs in CI as a GitHub Action.

3. ProveA one-file verifier checks an evidence bundle offline: records unedited, signed by the key you pinned, rules followed, and it tells you when records are missing.

In CI

- uses: ntinosgkiou-code/agentdryrun@v0.9.0
  with:
    rules: rules.json
    events: tests/agent-events.jsonl
    max-refused: 0
    max-unmapped: 0

Fails the build when your agent would do more than you accept. Reads Langfuse, LangSmith and OpenTelemetry exports too.

What it is not

A prototype with no external security review. It does not certify anything, does not make you compliant with any regulation, and does not stop prompt injection. The recorder logs attempts, not outcomes or approvals. The example data is invented. Read the known limits.

Help wanted

The most useful thing you can do: try it on a real export and tell us if it fails, or try to break the verifier. Open issues include good first issues.