Skip to content
yoru.sh

Audit trail for autonomous coding agents

Know what your agent did last night.

Every tool call, every prompt, every response. Audit-grade trails for your Claude Code sessions. Self-hosted on your own box.

See the full prompt
See a sample trail

click the command · first trail in 60 seconds

Open source. Self-hosted. Your data never leaves your network. Export everything, any time.

Stand up your own instance: docker-compose up
~/yoruinstall
pipx install yoru-cli && yoru init --server https://yoru.acme.com
install

not an LLM proxy. not a fork of Claude Code. not your terminal scrollback.

A hook, a grade, six red flags. Per session.

  • ~40tool calls per runevery file edit, every shell, every SQL
  • 0%reviewed the next morningof what your agent did overnight
  • 6red-flag categories that catch itsecret · shell · db · env · migration · ci

Three jobs. One pipeline.

  • INGEST

    Every tool call, every prompt, every response.

    A Claude Code hook forwards agent events the moment they happen. The transcript tailer picks up what the hook misses: your prompts, Claude's replies, thinking blocks. No SDK, no proxy, no trace() wraps. Full conversation, searchable timeline.

  • FORENSICS

    Red flags, and a grade for the session.

    yoru flags six patterns at ingest: secrets, rm, destructive SQL, .env writes, migrations, CI config. Every session also gets a letter grade A to F on three axes: Throughput, Reliability, Safety. You open a session already knowing whether it needs review.

  • AUDIT TRAIL

    Audit trail, in one file.

    Download any session as a single JSON file: every prompt, every tool response, every diff. Sign it, attach it to the PR, email it to legal. Keep it in S3 for seven years. Done.

A grade that tells you something.

Every Claude Code session lands with a letter grade A to F and three bars: Throughput, Reliability, Safety. Strong throughput and zero errors don't hide a leaked AWS key. The axis that fails caps the whole.

A
session grade
  • Throughput
    100
  • Reliability
    100
  • Safety
    72

27 files · 478 tool calls · 0 errors · 1 flagged edit

Methodology anchored in DX Core 4 + SPACE (Microsoft Research). Geometric mean across axes. Critical flags cap the score.

Read the methodology

Six signals. One red badge.

Six patterns that turn an overnight agent run into an incident you have to explain on Monday. Flagged at ingest. Severity-weighted. You decide if it's real.

SECRET

Matched AWS / Stripe / JWT / SSH private-key pattern in an event payload.

sk_live_…
ENV

Agent wrote to a file matching .env* outside .env.example.

.env.production
SHELL

Shell tool call included rm, dd, or mkfs.

rm -rf node_modules
DB

Agent ran DROP, TRUNCATE, or an unscoped DELETE / UPDATE.

DROP TABLE sessions
MIGRATION

Agent edited a file under migrations/, prisma/, or alembic/.

005_drop_users.py
CI

Agent modified .github/workflows/, vercel.json, or Dockerfile.

deploy.yml

Audit-ready, in one file.

Every prompt, every tool response, every diff. A Yoru session downloads as a single JSON file. Attach it to the PR. Email it to legal. Keep it in S3 for seven years. Your auditor has opinions. This file has answers.

yoru-ae817188-b484-4335-86bf-af893da6ee12.json124 KB
{  "session": { "id": "ae81…", "grade": "A", "tool_count": 14 },  "events": [    { "ts": "2026-04-18T12:24:58Z", "type": "message" },    { "ts": "2026-04-18T12:25:19Z", "type": "file_change", "flags": ["secret_aws"] }  ]
}

Your box. Your network. Your rules.

yoru is self-hosted. MIT CLI, AGPL server. docker-compose up, point the CLI at your own URL, done. No tenant, no seat math, no paywall, every user gets everything. Your session data never leaves your network.

Run it yourself Self-host guide

Questions devs actually ask

  • Do I need to change how I use Claude Code?
    No. The hook installs once, runs after every event, and never blocks. Claude Code doesn't notice Yoru exists. If you uninstall, Claude Code keeps working. Yoru was never in the critical path.
  • Can I self-host?
    Self-host is the only way to run Yoru. The CLI is MIT, the server (backend + dashboard) is AGPL. git clone, docker-compose up, point your CLI at your own URL. One full product — no crippled “community edition”, no paid tier you're missing.
  • What about Cursor or Aider?
    Claude Code is supported today. Cursor and Aider write the same transcript-file shape, so the capture layer works. We're aligning the hook contract for each. Star the repo if you want a ping when they land.
  • Does Yoru slow my agent down?
    No. The hook is post-event: it fires after Claude Code finishes a step, not during. The POST runs with a 2-second timeout and || true, so a Yoru outage never stalls your terminal. We watch; we don't gate.
  • Where does my data go?
    To the Yoru instance you run. Nowhere else — it's your server, on your network. The CLI only POSTs to the --server you set; never to us, never to a third party. The code is public, grep the repo.
  • How is this different from Langfuse or Helicone?
    Those track the LLM calls your product makes to serve your customers. Yoru tracks the coding agent sessions your developers run to build the product. Different buyer, different scope. You'd use both.
  • What does it cost?
    Nothing to us — there's no hosted Yoru to bill you for. It's open source: run it on your own box and you get the whole product, every red-flag rule, unlimited retention, full data export. Your only cost is the box you run it on.

Start tonight. Review tomorrow morning.

One pip install from now, your next Claude Code session is a trail. Skip the scroll-and-hope. Wake up knowing.

See a sample trail

Open source · MIT CLI · AGPL server · GitHub