AI coding agents run shell commands, spawn subagents, call MCP servers and push code. When one goes rogue, the evidence is on the endpoint. AgentDFIR collects it, seals it, and shows you what actually happened — Claude Code, Codex CLI, Cursor, Gemini CLI, Copilot.
Zero runtime dependencies · Never executes suspect binaries · Never follows symlinks
$ agentdfir triage CASE-2026-042.adfir HIGH — Unexpected Agent Activity [ORPHAN_AGENT] Agent: adad4e2c Parent: UNKNOWN Finding: Agent appeared without a verified parent invocation. Related: SendMessage/resume interaction with agent a7c3f19b Evidence: …/agent-adad4e2c.jsonl:1 Status: OBSERVED Endpoint: UNKNOWN $ agentdfir verify CASE-2026-042.adfir Result: VERIFIED — no modifications detected
Evidence vs. claims
AI-generated text is never automatically treated as evidence of execution. Every action in every timeline carries an explicit corroboration state — so model narrative can never masquerade as confirmed host activity.
| State | Meaning |
|---|---|
| REQUESTED | A human asked for it |
| REPORTED | The model said it happened — narrative, not proof |
| OBSERVED | A tool-call record exists in the transcript |
| CORROBORATED | Independent endpoint or network evidence confirms it |
| CONTRADICTED | Endpoint evidence shows it did not occur |
| UNKNOWN | Insufficient evidence — stated honestly |
Built for hostile hosts
Every design decision assumes the host is compromised and the evidence is adversarial.
Every acquisition produces a sealed .adfir package: content-addressed storage, SHA-256 manifest, and a seal covering the entire evidence zone.
Collection and chain-of-custody logs are hash-chained — editing, deleting or forging a single record breaks the chain for everything after it.
One flipped byte anywhere in the sealed zone fails verify — and it names the exact artifact that was modified.
Suspect binaries are never executed. Symlinks are never followed. ANSI escapes and invisible Unicode are neutralized — your terminal is part of the attack surface.
Sessions, agents, subagents, tool calls and MCP servers reconstructed into one evidence-linked timeline. Every entry traces to a file, line and hash.
agentdfir simulate generates synthetic rogue-agent incidents — orphan agents, cross-session messaging — to validate detections and train responders.
Open format
.adfir evidence packageSelf-describing and independently parseable — any forensic tool can read it without AgentDFIR. Raw evidence is sealed once and never touched; analysis output is a regenerable overlay.
Quick start
# Discover installed AI tooling — never executes suspect binaries agentdfir detect # Forensic acquisition: lossless, sealed, hash-chained agentdfir collect --product claude --operator "Your Name" --case-id CASE-2026-042 # Tamper-evident verification agentdfir verify CASE-2026-042.adfir # Unified, evidence-linked timeline + rule-based detections agentdfir timeline CASE-2026-042.adfir agentdfir triage CASE-2026-042.adfir
Reference
AI agent forensics is the discipline of collecting, preserving and analyzing the evidence agentic AI tools leave on endpoints — session transcripts, subagent records, MCP configurations, hooks and tool-call logs — so an incident responder can reconstruct who instructed which agent to perform what action, through which tool and identity, and what evidence proves it.
Claude Code stores session transcripts as JSONL under ~/.claude/projects/<project>/<session-id>.jsonl, with prompt history in ~/.claude/history.jsonl, settings, hooks, skills, plugins, task state and file-history checkpoints under ~/.claude/, and global configuration (including MCP servers) in ~/.claude.json. AgentDFIR acquires all of them into one sealed package — including subagent and orphan-agent transcripts.
No. "I executed curl example.com" in model output is a claim — AgentDFIR marks it REPORTED. Only a tool-call record in the transcript upgrades it to OBSERVED, and only independent endpoint or network evidence makes it CORROBORATED. That distinction is the foundation of trustworthy AI-agent forensics.
Orphan agents (transcripts with no verified parent invocation), cross-agent messaging and unexpected resume interactions, destructive shell commands, shell-execution inventory, and transcript integrity gaps (truncated or malformed regions that reduce confidence in surrounding evidence). Detections are deterministic rules — no LLM in the analysis path.
MIT-licensed, zero runtime dependencies, single static binary. Built in the open for the DFIR community.
Technical reference
Machine-readable schemas and artifact references — cite them directly.
Portable raw binaries for USB / air-gap, install.sh, Homebrew tap, go install. SHA256 and Sigstore verification, and why unsigned downloads prompt on macOS and Windows.
Every on-disk location, the JSONL session schema, interpretation and collection commands.
agentdfir serve: agent tree, density-scrubber timeline, the raw transcript line behind every event, findings and topology — in your browser, loopback only, zero external resources.
collect --docker snapshots a container read-only; --archive ingests CI artifacts, support bundles and vendor exports — same sealed package, same analysis.
For every line of CLAUDE.md, AGENTS.md or .cursorrules: which session, agent and tool wrote it — and whether it entered as a human request or as tool output.
monitor --detect turns the read-only tail into a sensor: exfil sequences, honeytokens, self-modification and more pushed to webhook, syslog or file within seconds.
auditd, Sysmon and EDR exports as the second witness: which tool calls the OS confirms, which it contradicts, and what the agent did off the record.
Every MCP server across every agent on a host: unpinned packages, plaintext transports, auto-approve, poisoned tool descriptions, baseline drift, gateway-log corroboration. Read-only.
Investigating MCP server config and tool activity, baselines and tool-poisoning evidence.
Add any new AI agent product with one signed JSON file: detection, collector manifest and parser field map — no Go.
OCSF 1.3 events and findings, SARIF 2.1 for code scanning, Sigma export of rule packs — portable to EDR process telemetry.
Import KAPE / Velociraptor / CyLR trees into one sealed package; export Timesketch JSONL and l2tcsv timelines.
The open evidence-package format: two zones, content addressing, hash chaining, verification.
The unified agent forensic event schema (JSON Schema 2020-12).
Detection finding schema with evidence references and corroboration state.
ISO/IEC 27037, NIST AI RMF, GDPR, EU AI Act — capabilities that supply supporting evidence.