Raw agent logs stay on your machine.

The launch flow is local-first: parse, redact, and summarize locally; upload only the sanitized report JSON you can inspect first.

Agent Analyzer is an independent third-party tool and is not affiliated with Anthropic, OpenAI, Anysphere, Amazon, or Google.

Data Flow

supported local agent logs and bounded SQLite rows
  -> agent-analyzer CLI on your machine
  -> local secret scrubber and deterministic parser
  -> ./agent-analyzer-report.json
  -> optional user review with jq/cat
  -> POST /api/client-reports
  -> private report URL

Controls

No browser file picker and no hidden access to local agent directories.
No one-time bearer token pasted into a web-provided shell snippet for the public flow.
No raw transcript is sent to an LLM.
No raw supported agent logs or raw SQLite stores are received by the public web flow.
No model tools, browsing, shell, filesystem, memory, or MCP access are used for interpretation.
Server intake is bounded to sanitized report JSON and rejects reports that claim raw transcript LLM exposure.
Operational logs are allowlisted to metadata, timings, status, buckets, and error categories.

Threat Model

We assume agent logs are sensitive and may contain source code, command output, API responses, secrets, hostnames, usernames, and customer data. The primary mitigation is to keep raw logs local. Server-side retention and redaction are defense in depth, not the primary trust boundary.

run locally

Start with the read-only analyzer.

npx --yes agent-analyzer@latest run

Analyzes supported agent logs on your machine, asks before upload, and uses the sanitized report to build a custom plugin for the waste it finds.

Start from the analyzer homepage