Skip to content
Chethan Yadav
Work

Security/2026/Active

AgentNetra

See what your AI agents are really doing.

Go
Repository

Overview

AgentNetra is a local-first observability layer for autonomous AI coding agents. As tools like Claude Code, Cursor, and Aider run with increasingly broad permissions on developer machines, there's no built-in way to see which ones are active, how long they've been running, or what their process ancestry looks like — AgentNetra fills that gap by fingerprinting agent processes on the host and recording their lifecycle to a local SQLite database.

It's aimed at developers and security teams running several AI coding tools side by side who want one place to answer "what agent is running, since when, spawned from what parent process" without any of that data leaving the machine.

The project is early — currently v0.1.0, with agent discovery and session tracking shipped and a security/policy engine still on the roadmap — so it's best used today as a discovery and audit tool rather than a full governance platform.

Key Features

  • Agent discovery — detects running Claude Code, Cursor, Gemini CLI, Aider, Codex CLI, and OpenHands processes on the host
  • Process enumeration — walks the OS process tree (via gopsutil) to identify agent processes and their parent PIDs
  • Session tracking & lifecycle events — records when an agent starts, how long it runs, and status transitions to local SQLite storage
  • Cross-platform — one Go binary for Linux (amd64/arm64), macOS (amd64/Apple Silicon), and Windows (amd64), with no CGo dependency
  • Local-only data — everything is written to a local SQLite database; nothing is sent externally

Installation

git clone https://github.com/chethanyadav456/agentnetra.git
cd agentnetra
make install

Requires Go 1.24+.

Usage

# Scan for AI agents currently running on your machine
agentnetra scan
 
# List detected AI agents (running only)
agentnetra agents
 
# List all agents including stopped ones
agentnetra agents --all
 
# List recorded sessions
agentnetra sessions
 
# List lifecycle events
agentnetra events
 
# Print version
agentnetra --version

Example scan output:

$ agentnetra scan
 
AGENT    PID     PARENT PID   STATUS    DISCOVERED AT         COMMAND
-----    ---     ----------   ------    -------------         -------
claude   98321   97800        running   2026-07-03 16:10:05   claude --dangerously-skip-permissions
gemini   91245   91100        running   2026-07-03 16:09:40   gemini
 
Scan complete. Found 2 agent(s). Events: 2.

Configuration is read in priority order from AGENTNETRA_* environment variables, ~/.agentnetra/config.yaml, and built-in defaults:

AGENTNETRA_LOG_LEVEL=debug agentnetra scan

How It Works

AgentNetra is a Cobra-based CLI (spf13/cobra + spf13/viper for config) sitting on top of a small service layer. A discovery engine built on shirou/gopsutil scans the OS process table and matches known command signatures for each supported agent. Matches — along with parent PID, discovery timestamp, and status — are persisted through a storage layer to a local modernc.org/sqlite database, while an events engine records lifecycle transitions (started, stopped) as sessions evolve. Because scan, agents, sessions, and events all read from that same local store, the CLI stays a thin client over one source of truth.

Database location is platform-specific: ~/.agentnetra/agentnetra.db on Linux, ~/Library/Application Support/AgentNetra/agentnetra.db on macOS, and %APPDATA%/AgentNetra/agentnetra.db on Windows. Later roadmap milestones — token attribution, process-tree visualization, and a security/policy engine — are designed to build on this same event log rather than requiring a rearchitecture.

View on GitHub ↗