ToolReplay

OrcaReplay is an open-source replay and debugging tool for AI-agent executions, built by the OrcaRouter.ai team. It records an agent run as a local trace, including model requests and responses, tool calls and results, shell exit codes and timing, filesystem snapshots, MCP traffic, and selected network activity. It runs as a local proxy and capture layer around an unmodified agent. A proxy records model traffic, while PATH shims, JSON-RPC interception, filesystem snapshots, fetch hooks, and optional TLS interception capture effects that model transcripts cannot show. The resulting timeline can be viewed, exported, queried through JSON or MCP, and analyzed with recorded versus inferred causal edges. The same recorded stream supports offline replay with the network blocked, forking from a derived checkpoint onto another model, and comparison of several models with an optional verification command. Replay uses the recorded conversation and workspace state; interactive terminal sessions can be approximate because prompts and interactive-only tools may not exist on the wire. The CLI is installed with npm, requires Node 20 or newer, stores runs under `.orca/runs/`, and the code, CLI, viewer, adapters, and trace format implementation are released under Apache-2.0; the trace specification is CC BY 4.0. Traces are local and redacted on write, but the project describes them as sensitive and treats redaction as best-effort.

Reverify is an AI-agent verification toolkit for reverse engineering and related code analysis. It places deterministic tools between an agent and its claims: the model proposes hypotheses about a binary or candidate implementation, while parsers, disassemblers, pattern scanners, emulators, equivalence checks, and optional analysis engines compare them with ground truth and return evidence-backed VERIFIED, REFUTED, INCONCLUSIVE, OBSERVED, or INVALIDATED results. Its pure-Python core handles PE, ELF, and Mach-O parsing, x86/x64 and ARM/ARM64 disassembly, byte and pattern inspection, CPU micro-emulation, Protobuf/TLV dissection, and Frida hook generation; optional installations add Capstone, Unicorn, LIEF, Z3, or angr for deeper analysis. The project exposes the verification loop through a command-line interface and an MCP server that agents such as Claude Code and Cursor can call. It also records verified, observed, proved, and refuted results in a content-keyed local ledger, allowing grounded facts and negative findings to survive context resets, compaction, and new sessions. A rollover and orchestration system hands sessions off through files rather than model-written summaries, keeping verified facts separate from unverified notes. Reverify includes claim types for bytes, typed reads, instructions, patterns, emulation, behavioral or formal equivalence, imports, exports, sections, and—when angr is installed—functions, calls, references, and reachability. It is distributed from PyPI and licensed under the MIT License. The repository states that it is intended for authorized reverse engineering, malware analysis, CTF work, interoperability research, and software the user owns or is permitted to analyze.

TrustMeBro is a Go command-interception tool for controlled red-team testing of coding agents such as Codex, Claude Code, and pi. It uses PATH shims to intercept configured command-line tools without requiring a plugin, hook, or MCP integration; rules can spoof generated or fixed output, rewrite stdout from a real command while preserving stderr and its exit status, pass through to the real binary, or reject the call. Each decision is recorded in a timestamped JSONL audit log. Rules match command names, domains, DNS record types, argument globs, and regular expressions. The bundled DNS generators support dig, nslookup, and host, while custom shims can use fixed output, exit codes, and standard streams. On Linux, lab mode uses Bubblewrap to shadow PATH lookups and discovered absolute paths so an agent cannot bypass interception merely by invoking a resolved system binary. TrustMeBro is distributed as a single MIT-licensed Go binary with installation, configuration validation, status, rule-listing, and uninstall commands. Lab mode requires Linux and Bubblewrap and is explicitly an interception namespace rather than a security sandbox: it reuses the host filesystem, workspace, network, environment, and agent credentials. Outside lab mode, absolute paths, changed PATH environments, and in-process DNS clients can bypass command shims.

cc-prune is a Python command-line tool for surgical context recovery in Claude Code sessions. It removes already-processed tool output from a Claude transcript while preserving conversation text, reasoning, thinking blocks, transcript structure, and tool-call relationships; it does not summarize or truncate the retained content. The workflow measures actual API usage, inspects transcript byte buckets, optionally audits individual results, and clears selected buckets such as tool results, inputs, attachments, or orphaned command output. Clear operations use a character-length threshold, can protect a tail of recent records, create numbered snapshots, validate invariants, and support restoration. Its validation checks include unchanged record and UUID/parent-UUID chains, byte-identical thinking signatures, and matching tool-result and tool-use identifiers. The tool operates on Claude Code JSONL transcripts under the user's .claude/projects directory and requires the session to be stopped before editing. It supports usage verification after pruning, snapshot listing and restoration, and density calculations based on measured token counts. The project states that the Claude Code transcript format is undocumented and version-sensitive, and that cleared results may need to be regenerated; it is distributed under the MIT license and requires Python 3.9 or later with no dependencies.