AI Audit Logs

Gryph is a security layer for Claude Code, Cursor, Gemini CLI, Windsurf, OpenCode, Pi Agent, and more.

• It intercepts every tool call, such as file reads, writes, and shell execution, via hooks and stores them in local SQLite.
• It receives both pre-tool/post-tool events, allowing it to reconstruct the session flow from read → execute → modify → revert.
• Use gryph logs, gryph query, gryph session, gryph diff, and gryph export to check recent activity, specific file access, and command execution history.
• Sensitive files such as .env, *.pem, *.key are automatically detected, and only the fact of access is recorded, not the content.
• It works as an installed hook rather than a login setting, and Codex requires the codex_hooks = true flag.
• Publicly supported range is Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Pi Agent, and Windsurf, with installers and binaries provided for macOS/Linux/Windows.