Rano banner
Dicklesworthstone Dicklesworthstone

Rano

AI community

Description

Network observer that tracks outbound connections from AI CLI processes (Claude Code, Codex, Gemini), attributing sockets to providers in real time with SQLite logging

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

rano

rano - network observer for AI CLI processes

[![Release](https://img.shields.io/github/v/release/Dicklesworthstone/rano?sort=semver)](https://github.com/Dicklesworthstone/rano/releases)

rano is a **network observer for AI CLI processes** that tracks outbound connections from Claude Code, Codex CLI, Gemini CLI, and their descendants—live in your terminal and durably in SQLite.

Quick Install

curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/rano/main/install.sh | bash

TL;DR

**The Problem**: AI CLI tools spawn subprocesses and open sockets you can’t easily attribute back to a provider or process in real time.

**The Solution**: rano polls `/proc`, maps sockets to PIDs, and prints connection events with provider tags while logging a complete history to SQLite.

Why Use rano?

Feature What It Does
Provider-aware Tags traffic as anthropic, openai, google, or unknown.
Descendant-aware Follows child processes automatically.
Live stats In-terminal summaries with top IPs/domains and provider totals.
SQLite logging Queryable history with built-in aggregate views.
Flexible output Pretty or JSON output + optional file logging.

Quick Example

# Observe default AI CLIs (claude/codex/gemini)
./rano

# Narrow to Codex + log JSON
rano --pattern codex --json --log-file /tmp/rano.log

# Run with per-run log files
rano --log-dir /tmp/rano-logs --log-format json

# Track a specific PID (no descendants)
rano --pid 1234 --no-descendants

# Emit a single poll and exit
rano --once

# View SQLite aggregates
sqlite3 observer.sqlite "select * from provider_counts;"

Design Philosophy

  1. Trustworthy attribution: tie sockets to PIDs and command lines, not guesses.
  2. Low overhead: pollin