Runs locally · no telemetry · MIT

AgentLedger

The trust layer for AI coding agents

Claude says done. AgentLedger checks — against real exit codes, not self-reports.

Install the plugin View source
agentledger — catching a false completion claim
AgentLedger blocking a protected-file write and falsifying a 'tests pass' claim in Claude Code

A protected-file write blocked before disk, and a “tests pass” claim caught against a non-zero exit code.

One install. Every session observed.

Two lines inside Claude Code — or the same install from your terminal.

Claude Code
/plugin marketplace add aryansahni30/AgentLedger /plugin install agentledger@agentledger
Terminal
$ claude plugin marketplace add aryansahni30/AgentLedger $ claude plugin install agentledger@agentledger
npm
$ npm install -g agentledger-plugin

Either plugin command wires all five hooks automatically — no settings.json editing. The ledger is created on first run and every session is scored from then on. The npm package is what the marketplace installs; pulling it directly only places the files on disk — run the plugin command to register the hooks.

What it does

Claim verification

Completion claims — “tests pass,” “fixed the bug” — are checked against the real test command’s exit code. The agent’s word is logged, never trusted.

Boundary enforcement

Writes to protected paths — .env, keys, secrets — are blocked before they ever touch disk, and the denial is recorded.

Hash-chained ledger

Every action lands in an append-only, SHA-256 hash-chained log — reads, edits, blocked writes, verified and falsified claims. The chain breaks if anyone tampers.

How it works — five hooks, every session
SessionStart Setup Creates .agentledger/, validates the chain, prints the trust banner, starts the local dashboard.
PreToolUse Prevent Blocks Edit/Write to protected paths before disk (exit code 2); warns on sensitive ones.
PostToolUse Record Records each Edit/Write/Bash/Read to the ledger and tracks the read:edit ratio.
Stop Verify Scans the turn for a completion claim; on a hit, runs the real test command → verified or falsified.
SessionEnd Detect git diff boundary check + test run; writes the session summary and updates the trust score.
Prevention before disk · detection & verification after → SHA-256 chained · .agentledger/ledger.jsonl