AnEntrypoint

Audit Cc Tail — Security skill for Claude Code

Security community

Detects distinct Claude model variants per family from behavioral fingerprints in Claude Code JSONL history.

How to install Audit Cc Tail

This entry records only its repository, not the path inside it, so there is no exact command to give. Open AnEntrypoint/audit-cc-tail and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Audit Cc Tail does

Detects distinct Claude model variants per family from behavioral fingerprints in Claude Code JSONL history.

Alternatives in Security

Google Workspace Model Armor — Filter user-generated content for safety 21.6k ★
Security Threat Model — Generate repo-specific threat models identifying trust boundaries 14.6k ★
Pal — Multi-model AI integration — chat, debugging, code review, planning, security audit 11.3k ★

README

audit-cc-tail

Detects how many distinct model variants Anthropic is serving behind each Claude family name (haiku / sonnet / opus) by clustering behavioral fingerprints extracted from your local Claude Code JSONL history.

Clusters both **text responses** (stylometric features) and **tool-call responses** (structural features) separately — giving two independent signals per family.

Grows more accurate over time as more responses accumulate.

How it works

Ingest — reads ~/.claude/projects/**/*.jsonl (parallel backfill + live watch), classifies each response as text, tool_use, or mixed, extracts feature vectors for both text and tool content
Cluster — runs sklearn.BayesianGaussianMixture (Dirichlet process prior) per family × mode (text + tools); active component count = estimated distinct model variants
Dashboard — 3-column TUI (one panel per family) with scrollable sections, token analytics, model version progression, daily sparklines, and both text and tool cluster views

Requirements

Bun ≥ 1.3
Python ≥ 3.10 with scikit-learn and numpy
Claude Code installed (provides ~/.claude/projects/)

Setup

bun install
python -m pip install scikit-learn numpy

If Python is not at `C:/Python312/python.exe`, update `PYTHON` in `src/cluster.ts`.

Usage

bun start

Migrates the DB, then spawns ingest + cluster (hourly) + dashboard as child processes. Auto-restarts crashed workers. `Ctrl+C` kills all.

Individual commands:

bun run src/index.ts migrate     # apply schema only
bun run src/index.ts ingest      # backfill + watch
bun run src/index.ts cluster     # cluster once
bun run src/index.ts cluster --watch  # cluster hourly
bun run src/index.ts dashboard   # TUI dashboard

Dashboard keys: `tab` — switch panel focus | `j/k` — scroll | `q` — quit