Claude Code Gets Tracked Too

Gryph is a security/audit layer for Claude Code, Cursor, Windsurf, Gemini CLI, OpenCode, Pi Agent, and more.

Whenever an agent reads or writes a file or executes a shell command, it receives a JSON event and stores it in a local SQLite database, also recording pre-tool / post-tool events together so the flow before and after an action can be reconstructed.

The core features are as follows.

• Session replay: Check in order which files were read and which commands were executed
• Query/filtering: Look up by agent, file pattern, command, session, or time period
• Diff viewing: Track the changes in file write events
• Real-time monitoring: Stream events with gryph logs --live
• Sensitive info protection: Automatically detects .env, *.pem, *.key, .ssh/**, .aws/**, etc., and does not store their contents

Storage is stated to be local-only, with no cloud, telemetry, or tracking features. The default retention period is 90 days, and the output level can be adjusted between minimal / standard / full. In full mode, you can even view file diffs, raw events, and conversation context.

During installation, it modifies the configuration files for Claude Code, Codex, Cursor, Gemini CLI, OpenCode, and Windsurf individually, and backs up existing configurations. It also provides a CLI with commands like gryph install, gryph status, gryph query, gryph export, and gryph stats for checking installation status, querying audit data, exporting, and viewing statistics.