Coding Agent Forensics

coding-agent-forensics

**Offline, single-file forensic viewer for AI coding-agent transcripts.**

Drop in sessions from Claude Code, Codex, Copilot, Cursor, Gemini, Cline, Goose, Aider, OpenCode, Hermes, or DeepSeek Harness and get a searchable timeline, reconstructed file diffs, and rule-based flags for credentials, exfiltration, and git history rewrites. Nothing leaves the browser.

Try it: [**live demo**]( https://shorton88.github.io/coding-agent-forensics/) — same tool, running in your browser. Files are still processed locally and nothing is uploaded. For actual casework, download the release asset.

Why

Coding agents now read files, run shell commands, edit source, and talk to the network on a developer's behalf. Every one of them writes a complete record of what it did to local disk. That record is an underused evidence source: it is often the only place showing what an agent was *told*, what it *saw*, and what it *ran* — including the injected context the developer never typed and may never have seen.

The existing tooling for these files is aimed at developers debugging their own sessions. This is aimed at whoever has to review someone else's, after the fact, on a machine that may not be allowed to talk to the internet.

What it is

One HTML file. About 210 KB. No build step, no dependencies, no CDN, no network calls of any kind.

Open it from `file://`, drag transcripts onto the window, and read. Everything is parsed in the browser and nothing is uploaded — which is the point, because these files routinely contain credentials, proprietary source, and customer data.

git clone https://github.com/Shorton88/coding-agent-forensics
open coding-agent-forensics/coding-agent-forensics.html

Or download the single file from Releases and open it. That is the whole install.

Screenshots

Timeline and risk rail	Findings across sessions