Show HN: Logira – eBPF runtime auditing for AI agent runs

Source: Hacker News

Overview

I started using Claude Code (claude --dangerously-skip-permissions) and Codex (codex --yolo) and realized I had no reliable way to know what they actually did. The agent’s own output tells a story, but it’s the agent’s story.

Logira records exec, file, and network events at the OS level via eBPF, scoped per run. Events are saved locally in JSONL and SQLite. It ships with default detection rules for credential access, persistence changes, suspicious exec patterns, and more. It operates in observe‑only mode – it never blocks.

Features

• eBPF‑based monitoring of exec, file, and network events, scoped per run.
• Local storage of events in JSONL and SQLite formats.
• Default detection rules for:
  • Credential access
  • Persistence changes
  • Suspicious execution patterns
  • …and more.
• Observe‑only mode – never blocks any activity.

Repository

Logira on GitHub

Discussion

Hacker News comments (12 points)