gitwtfhub

wtf is snitchit?

thisisnithin/snitchit — explained in plain English

Analysis updated 2026-05-18

1RustAudience · developerComplexity · 3/5Setup · moderate

TL;DR

A local, observe-only Rust tool that records everything an AI coding agent does in your terminal into a tamper-evident log, never sending data over the network.

Mindmap

mindmap
  root((snitchit))
    What it does
      Records terminal AI agents
      Hash-chained log
      Observe only
    Tech stack
      Rust
      eBPF
      Endpoint Security
    Use cases
      Audit agent actions
      Replay sessions
      Detect tampering
    Audience
      Developers
      AI agent users

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Why would anyone build with this?

REASON 1

Keep a local, tamper-evident log of everything an AI coding agent does in your terminal.

REASON 2

Audit what tool calls a Claude Code or OpenCode agent actually made during a session.

REASON 3

Replay a recorded coding agent session as a self-contained HTML timeline.

REASON 4

Track subprocesses and network connections an AI agent's process tree opens.

What's in the stack?

RusteBPFCargo

How it stacks up

thisisnithin/snitchitabc3dz/mixxxabyo-software/ferro-stash
Stars111
LanguageRustRustRust
Setup difficultymoderatemoderatemoderate
Complexity3/52/54/5
Audiencedevelopergeneralops devops

Figures from each repo's GitHub metadata at analysis time.

How do you spin it up?

Difficulty · moderate Time to first run · 30min

Basic recording needs no privileges, the deepest kernel-level tier requires eBPF capabilities on Linux or Developer Mode and root on macOS.

No license is mentioned in the README, so reuse terms are unclear.

Wtf does this do

snitchit is a Rust tool that watches what an AI coding agent does in your terminal and keeps a private, local record of it. You run your agent, like Claude Code or OpenCode, through snitchit, and it writes down what you typed, what appeared on screen, and, once set up more fully, the individual actions the agent itself takes, such as reading or writing files. The project makes three main promises. First, it never sends anything over the network, so nothing you record ever leaves your computer. Second, it only watches, it never blocks or changes what the agent does, and if recording itself fails for any reason the agent still runs normally. Third, the record it keeps is tamper evident: each entry is linked to the one before it using a cryptographic hash chain, so a command called verify can detect if someone edited the log afterward, though the author is clear this protection is local and unsigned, not a full security guarantee. snitchit can watch at three different levels of detail. The simplest level just watches the terminal itself, what you typed and what showed on screen, and needs no special permissions. A deeper level hooks directly into supported agents, Claude Code and OpenCode, to see their internal tool calls. The deepest level watches at the operating system level to catch other programs the agent launches and network connections it opens, using eBPF on Linux or Apple's Endpoint Security framework on macOS, and this level does require extra one time permission setup. To install it you build the project with Cargo and either run your agent explicitly through the snitchit command, or run an install step that wires it into your shell and into Claude Code or OpenCode automatically. You can also generate a self contained HTML file that lets you replay a recorded session in a browser. The project is written entirely in Rust, has one star so far, and its README does not mention a license.

Yoink these prompts

Prompt 1
Help me install snitchit and wire it into my Claude Code setup using the install command.
Prompt 2
Explain the difference between snitchit's terminal, hook, and kernel recording tiers.
Prompt 3
Walk me through enabling the eBPF kernel tier for snitchit on Linux.
Prompt 4
Show me how to use snitchit verify to check my recorded session log for tampering.

Frequently asked questions

wtf is snitchit?

A local, observe-only Rust tool that records everything an AI coding agent does in your terminal into a tamper-evident log, never sending data over the network.

What language is snitchit written in?

Mainly Rust. The stack also includes Rust, eBPF, Cargo.

What license does snitchit use?

No license is mentioned in the README, so reuse terms are unclear.

How hard is snitchit to set up?

Setup difficulty is rated moderate, with roughly 30min to a first successful run.

Who is snitchit for?

Mainly developer.

View the repo → Decode another repo

This repo across BitVibe Labs

Don't trust strangers blindly. Verify against the repo.