01
AI agent forensics
Something an agent did doesn't add up. Rebuild the session.
Replay keeps every command, file, and URL an agent touched, in order. You get the whole sequence, not just the alert that fired.
Ecliptica Replay · AI Detection & Response
Watch your AI agents
like you'd watch a network.
Ecliptica Replay watches what your AI agents do: the commands, files, and URLs they touch. Detection rules run locally, sessions rebuild from saved history, and you can opt into blocking per rule.
Free and local-first. Nothing leaves your machine unless you say so.
Use cases
What you'd actually use it for.
Replay runs one local engine. What you point it at depends on the job.
02
Policy and enforcement for AI agents
Set the boundaries, then make them stick.
Start in monitor-only while you learn the baseline, then opt into blocking per rule. Use the built-in catalog or write your own policy.
03
AI detection and response
Catch the behavior while it's happening.
Local detection rules flag suspicious actions as they occur — cloud metadata probes, credential access, unexpected egress — with the evidence attached.
04
Data-exfiltration watch
See the moment an agent reaches somewhere it shouldn't.
Domains, IPs, URLs, and file hashes are matched against threat intelligence, so a known-bad host or a paste site stands out from routine traffic.
05
Shadow AI discovery
Find every agent on the machine, and prove it's reporting.
Inventory the desktop, CLI, IDE, and gateway agents in use, then self-test each connector so a silent failure doesn't look like a quiet day.
06
Audit-ready local history
Keep a record you can hand to an incident review.
Activity lives in one local store on your machine. No cloud account, no external telemetry — something you can open and reason about later.
Security & SOC — detect, triage, reconstructPlatform & DevOps — policy, inventory, rolloutCompliance — a local audit recordIndividual developers — free, local monitoring
Capabilities
Built for the way agents work.
Replay sits between the agent and the system: it watches and records, and only blocks when you opt in.
Local-first by design
Everything Replay records is stored on your machine in a single file. No accounts, no cloud, no telemetry you didn't ask for.
Always-on protection
Monitoring keeps running even when the app is closed, so nothing slips through while you're away.
Detection rules
A built-in rule catalog, plus your own policy, runs locally against every action. Opt into blocking per rule, or stay monitor-only.
Session replay
Alerts reconstruct into full session timelines: every tool call, command, and file touched, in order. Child and sub-agent sessions stay distinct.
Threat-intel correlation
Observed domains, IPs, URLs, and hashes are matched against the Threat Landscape feed and surfaced as enriched alerts.
Verify your wiring
Wired doesn't mean working. A per-agent self-test confirms the connector really sends records, and a staleness flag catches silent failures.
Product
See it work.
One window for everything your agents did, and everything you should know about it.
Coverage
Works with the agents you already run.
Session rebuild restores activity from an agent's saved history. Live detection captures as it acts. Enforcement can block an action when you deploy a rule in enforce mode.
| Agent | Session Rebuild | Live Detection | Enforcement |
|---|---|---|---|
| Claude Code | ✓ | ✓ | ✓ |
| Claude Cowork | ✓ | — | — |
| Codex | ✓ | ✓ | ✓ |
| Gemini CLI | ✓ | ✓ | ✓ |
| Cursor | ✓ | ✓ | ✓ |
| Windsurf / Cascade | ✓ | ✓ | ✓ |
| GitHub Copilot CLI | ✓ | ✓ | ✓ |
| VS Code Copilot Chat | — | ✓ | ✓ |
| OpenCode | ✓ | ✓ | — |
| OpenClaw | ✓ | ✓ | ✓ |
| Pi | ✓ | ✓ | ✓ |
| Kimi Code | ✓ | ✓ | ✓ |
| Muse Code | ✓ | ✓ | ✓ |
| Antigravity | soon | ✓ | ✓ |
| Amp | soon | ✓ | ✓ |
| Auggie | soon | ✓ | ✓ |
| Cline CLI | soon | ✓ | ✓ |
| Crush | soon | ✓ | ✓ |
| Devin CLI | — | ✓ | ✓ |
| Factory Droid | soon | ✓ | ✓ |
| Goose | soon | ✓ | ✓ |
| Grok Build | soon | ✓ | ✓ |
| Hermes | soon | ✓ | ✓ |
| Junie CLI | soon | ✓ | ✓ |
| Kilo Code | soon | ✓ | ✓ |
| Kiro IDE / CLI | soon | ✓ | ✓ |
| OpenHands | soon | ✓ | ✓ |
| Qwen Code | soon | ✓ | ✓ |
Download
Free and local.
Replay ships as one file that includes the interface and the detection engine. No accounts, no installers that phone home.
Linux
x86_64needs the WebKitGTK runtime, which most desktops already have
↓ download
Windows
x86_64single .exe, self-contained
↓ download
macOS
Apple Siliconarm64 (Intel Macs: check back)
↓ download
Linux quick start:tar -xzf replay-linux-amd64.tar.gz && ./replay
These downloads always point to the latest release.
Free for non-commercial individual use. For commercial use, contact [email protected]. License · Third-party notices
Enterprise
Central visibility, without surrendering the local engine.
The free app stays fully local. The enterprise tier adds managed services on top: same engine, central control.
Talk to uscoming soon
Managed analytics
Central visibility over agent activity across every installation: detections, observables, blocked actions, and raw events, with sensitive values redacted.
Orchestration
Distribute your rules centrally, assign per team or host, and audit which rule version was effective, and where and when.