Install the CLI. Sign in. Wire your agent. Watch the lie surface.

The agentwatch client is a single Python file with no third-party dependencies (stdlib only). Install it as a CLI — the published package is agentwatch, exposing the agentwatch command. Use pipx (or uvx) so it lives on its own and stays on your PATH:

# recommended — isolated, on your PATH
pipx install agentwatch

# or run it without installing
uvx agentwatch --help

# or plain pip
pip install agentwatch

Confirm it’s wired up. With no key yet, status will say capture is gated OFF — that’s expected, and safe: the hook no-ops until you log in.

agentwatch status

Read it before you run it. The client is a single, dependency-free file you can vet end to end. Browse the public source, then pin the checksum so the file you vetted is the file you run — the file served at agentwatch.run/agentwatch.py matches the published SHA256 for the tagged release and the same commit in the repo:

# fetch the served file and confirm its checksum
curl -fsSL https://agentwatch.run/agentwatch.py -o agentwatch.py
shasum -a 256 agentwatch.py    # compare against the published SHA256

agentwatch is a login-gated cloud client. The key is scoped to your user + your active org. Just run login — no copy-paste:

agentwatch login

Your browser opens to the dashboard’s authorize page. You sign in (Clerk), confirm the active organization, and the page hands the minted key straight back to a localhost listener the CLI started. The key is written to ~/.agentwatch/config.json (chmod 600) and verified against the ingest API. No token ever touches your clipboard or scrollback.

The CLI waits up to 120 seconds for the browser. If it can’t open a browser (headless box, SSH session), it prints a fallback — open the /cli page, copy your key, and pass it explicitly:

# open https://agentwatch.run/cli, sign in, copy the key, then:
agentwatch login --key aw_live_...

# CI / ephemeral environments can skip the file entirely and use env vars:
export AGENTWATCH_API_KEY="aw_live_..."
export AGENTWATCH_INGEST_URL="https://api.agentwatch.run"

Switching org in the dashboard mints a different key — re-run agentwatch login to capture into the other org. agentwatch logout drops the key and the hook returns to a no-op.

agentwatch install writes the capture hooks for your agent. Pick the tool with --tool (default is claude-code). The CLI prints a [verified] or [BEST-EFFORT] stamp so you always know exactly what was wired and what still needs a confidence check.

agentwatch install --tool claude-code   # default — verified
agentwatch install --tool cursor        # best-effort
agentwatch install --tool codex         # best-effort
agentwatch install --tool replit        # documented (env + run-command)

Every hook calls agentwatch capture fire-and-forget, reading the tool’s hook JSON on stdin. The verdict is computed server-side when the ingest API receives the stop event, so nothing on the capture path ever blocks the agent. agentwatch uninstall removes the hooks again.

agentwatch install --tool claude-code
# → installed Claude Code hooks into ~/.claude/settings.json  [verified]

# then restart Claude Code (or run /hooks) to load them

agentwatch install --tool cursor
# → installed Cursor hooks into ~/.cursor/hooks.json  [BEST-EFFORT]

agentwatch install --tool codex
# → installed Codex hooks into ~/.codex/hooks.json  [BEST-EFFORT]

# 1) Tools → Secrets, add:
AGENTWATCH_API_KEY     = <your key>            # from agentwatch login / dashboard
AGENTWATCH_INGEST_URL  = https://api.agentwatch.run
AGENTWATCH_USER_EMAIL  = you@org.com           # optional

# 2) install the CLI in the Repl shell:
pip install agentwatch

# 3) capture reads those env vars (no config file needed) and posts events.
#    If your agent supports hooks/notify, point them at:
agentwatch capture

#    Otherwise pipe a hook-shaped event to it, e.g. on completion:
echo '{"hook_event_name":"Stop","last_assistant_message":"done"}' | agentwatch capture

Restart the agent and give it a task it might be tempted to fib about — the canonical one is “fix the failing test and make sure all tests pass, then commit.” If the agent says it ran the tests but the action log shows no test command, agentwatch catches it. Not near a terminal? Post a synthetic session to verify the pipe:

agentwatch demo

Open the dashboard. Each session gets a verdict; a caught session reads like this:

The dashboard shows each session at /sessions and /sessions/[id]: the prompt, the captured timeline, every deterministic check, and the verdict. No verdict appears until a stop event arrives — that is the agent’s final summary, which is the claim we diff against.

To capture every contributor without asking each one to wire hooks by hand, install at the repo level. From the repo root:

agentwatch install --repo --org tripshepherd

# also works per-tool:
agentwatch install --repo --tool cursor --org tripshepherd

This writes the capture hooks into the project config (for Claude Code, <repo>/.claude/settings.json) plus a committed marker at <repo>/.agentwatch/repo.json recording the org slug and tool. Commit both — they hold no secret. Every contributor who pulls the repo gets the hooks automatically.

{
  "org_slug": "tripshepherd",
  "tool": "claude-code",
  "ingest_url": "https://api.agentwatch.run"
}

Secrets are never committed. The hooks are inert until a developer has their own key. Each teammate runs this once on their machine — their key lives in ~/.agentwatch, scoped to their own user + org:

agentwatch login

A contributor without a key captures nothing — the hook stays a silent no-op, so committing the project hooks can never leak anyone’s code or block anyone’s agent.

The prime directive of redaction: code never leaves the machine. Redaction happens at source, in the capture client, before anything is transmitted. The ingest gateway re-applies the same rules as defense-in-depth, but the client is the first and primary guard.

Concretely, the masker keeps only the head the verifier matches on and drops everything that could hide code or a secret:

pytest -q tests/test_auth.py        ->  pytest -q [redacted]
git commit -m "fix the leak"        ->  git commit [redacted]
curl -H "Authorization: Bearer x"   ->  curl [redacted]
npm test                            ->  npm test

# a file body becomes a hash; only the path survives:
{ "tool": "Edit", "file": "src/auth.py",
  "body_sha256": "sha256:9f86d0818…" }

The masker keeps two leading tokens because that is all the verifier needs — git commit, npm test, cargo build. Masking the rest loses no detection signal. Only structural metadata ever crosses the wire, and only once you’re logged in — without a key, capture transmits nothing at all.

Being honest about what isn’t shipped yet:

• Cursor & Codex end-to-end verification. Both are wired against the current documented hook formats and marked [BEST-EFFORT] by the CLI itself. We’re promoting them to verified as we confirm captures land for each.
• A full MCP server. agentwatch is a capture client today, not an MCP server. Native MCP integration is roadmap, not shipped.