ai-rCAUTION
Read local AI agent sessions (Claude Code, Codex, OpenCode, Antigravity, Pi): intents, plans, tools
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/pro-target/ai-r/actions) [](https://github.com/pro-target/ai-r/actions) [](https://github.com/pro-target/ai-r/actions) [](./LICENSE) [](https://www.python.org/downloads/)
English | Русский | 中文 | 日本語 | Español
An agent reported "done." There's nothing to check it against.
ai-r reads the session history of any of the five coding agents and lets a fresh agent cold-check what git can't answer:
- did it lie, did it break anything — did it keep its word, did it run anything
dangerous (and roll it back if it did), what it actually changed, what it cost;
- why it went that way — under which plan, with what intent, and whose hand was
behind the edit.
Across our own corpus — 1600+ sessions of five agents in 20+ projects — that's how we found 312 risky commands (rm -rf,curl|sh,git push --force): the agent caught and rolled back two itself; the other 310 ran silently —gitwon't show them.
git shows what made it into the code; ai-r shows whether you can trust how the agent got there. Read-only: no LLM calls, no network.
Quick example — an agent asks about history
The primary mode is MCP: an agent (Claude, Codex, ...) calls ai-r directly and asks about history in plain language. For example — pull the plan the previous agent settled on, drafts discarded:
Show me the plan from the last session — final only, no intermediate revisions. → plan(session=..., kind="final") → get_body(id, shallow=true) plan: "Migrate auth to
02f774875659OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-session-reader -- uvx agent-session-reader==0.4.2
Exposed tools (20)
17 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
aggregate | read | Roll a list of row dicts up by ``group_by`` — the generic stats verb. |
audit_brief | read | Token-lean, budgeted session digest for auditors — the *audit_brief* preset. |
detect_current | read | Return the current runtime identity (session + agent) from env/fs. |
diff | write | Stitch edit rows into a per-file chronological diff — the diff verb. |
find_file_edits | write | Find every file edit across sessions, cross-agent by default. |
find_tool_calls | read | Find every tool call across sessions, cross-agent by default. |
get_body | read | Return the on-demand body for an event / plan ``id``. |
incidents | read | Dangerous shell commands + regret reactions — the *incidents* preset. |
list_sessions | read | List discoverable sessions, optionally filtered by ``agent``. |
locate | read | Find a session across all agents by uuid / id-prefix / title — *locate*. |
network | read | Network-egress audit — the *network* preset (F4.3). |
plan | read | Normalized plan atoms for a session — final vs drafts, grouped by task. |
query | read | Filter/search the unified session **event** stream — the workhorse verb. |
quotes | read | User quotes of prior in-session content — the *quotes* preset. |
read_session | read | Read a single session by ``uuid``; ``agent`` is an optional hint. |
rendezvous | write | # Blocks until all N calls arrive — only possible if they run in |
search_sessions | read | Case-insensitive search across sessions. |
session_diff | read | Reconstruct *what the agent changed* in one session — without git. |
session_stats | read | Summarise sessions, grouped and ranked — the *bird |
whoami | read | seen[ |
Trust audit
CAUTIONgrade F · trust 51/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
"secret_in_query", # ...or on the search-query text (exfil shape)
log "then set agent MCP configs to http://127.0.0.1:8756/mcp"
"http://127.0.0.1:*",
_marker("работает", r"\bзаработал[оа]?\b|\bработает\b|\bсработало\b"),_marker("готово", r"\bготово\b"),_marker("отлично", r"\bотлично\b|\bсупер\b|\bкласс\b|\bогонь\b|\bидеально\b"),_marker("спасибо", r"\bспасибо\b|\bблагодарю\b"),_marker("ок", r"\bок\b|\bокей\b"),ANTHROPIC_KEY = "sk-ant-api03-abc123def456ghi789"
secret = "sk-abc123def456ghi789jkl012mno345"
secret = "sk-abc123def456ghi789jkl0mno"
token = "ghp_0123456789abcdef0123456789abcdef0123"
- **Preconditions:** none. `[hermetic-ok]` (seed under `AI_R_HOME` one claude session whose title AND a message body contain a fake `ghp_0123456789abcdefghijklmnopqrstuvwxyzA`).
"ghp_0123456789abcdef0123456789abcdef0123\n"
assert "ghp_0123456789abcdef0123456789abcdef0123" in raw_serialized
token = "ghp_0123456789abcdef0123456789abcdef0123"
"ghp_0123456789abcdef0123456789abcdef0123")},
"-----BEGIN RSA PRIVATE KEY-----\n"
SLACK_TOKEN = "xoxb-1234567890-abcdefghij"
- **Preconditions:** none. `[hermetic-ok]` (seed one synthetic claude session whose turns paste a fake `sk_live_0123456789abcdefghij`, a fake three-segment `eyJhbGciOi....eyJzdWIi....sig` JWT, and a f
h = hashlib.sha1(db_path.encode()).hexdigest()[:16]
> claude mcp add --transport http ai-r http://127.0.0.1:8756/mcp
3. Point each agent at `http://127.0.0.1:8756/mcp` (Claude:
`claude mcp add --transport http ai-r http://127.0.0.1:8756/mcp -s user` —
> `curl|sh`, `git push --force`): el agente detectó y revirtió dos por sí mismo;
Gates applied: no_behavioural_pass.
02f774875659full audit observations/trust-audit/mcp-server/pro-target__ai-r.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 02f774875659 | CAUTION | F | 51 | first audit |
Questions
What is the ai-r MCP server?
Read local AI agent sessions (Claude Code, Codex, OpenCode, Antigravity, Pi): intents, plans, tools
What tools does ai-r expose?
20 in total: 17 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ai-r safe to connect to an agent?
With care. The audit graded it F (51/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does ai-r need?
It reads AI_R_DEDUP_KEY_LEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ai-r run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as agent-session-reader.
How current is this page?
The grade is for one exact copy of the source (02f774875659), read on 2026-10-11. The repository is watched and re-audited when it changes.