Session security
Opt-in reports on risky agent sessions: leaked secrets, the lethal trifecta, MCP changes and suspected injection.
Coding agents read private files, fetch content from the internet and run commands. Session security looks at each Claude Code or Codex session on your machine and flags the risky ones. Detection runs locally. Only counts and categories leave the machine, and only after you opt in.
What it detects
| Signal | What it means |
|---|---|
| Exposure | A secret pattern (API key, token, private key) went to a provider. Only the count and category are reported, never the value. |
| Trifecta | The session combined private data, untrusted input and a way to send data out. That is the setup a prompt injection needs. |
| MCP drift | An MCP server changed its tool definitions between sessions. Servers and tools are reported as opaque references. |
| Suspected injection | The agent changed behavior right after reading untrusted output. A deterministic heuristic, reported as ordinals and categories. Instructions read from agent context files (AGENTS.md, CLAUDE.md, .cursorrules, .mcp.json) are labeled context_file. |
| Policy decision | What the trifecta policy would have done with an action (see shadow mode below). |
Turn it on
1. Give consent in the app
Open Guard › Sessions. The consent screen lists every field that will be shared, who can see it (workspace owners) and how long it is kept. Consent is per developer and per workspace. A workspace write token is never treated as your consent.
2. Enroll this machine
Enroll an installation on the same page. The app shows a one-time command for your terminal:
tallygraph security enroll --credential <c> --workspace <id> --installation-id <name> --generation <n>
3. Collect
tallygraph security collect --dry-run # preview, sends nothing tallygraph security collect tallygraph security status
Add --spend to attach local usage to each session, so owners see how much was spent in risky sessions. Session security runs on its own: collect and the background service do not upload it.
What is shared
| Shared with owners | Never leaves your machine |
|---|---|
| Your member identity, from the enrolled credential | Transcript content |
| Opaque session and installation references | Prompts and responses |
| Agent (claude or codex) and session start and end | Secret values |
| Signal counts, categories and severity | File paths and shell commands |
| Detector coverage and versions | Raw URLs, tool arguments and MCP descriptions |
- Only sessions first seen after you opt in are shared. Nothing older is backfilled.
- Reports expire 30 days after the session. They are hidden at that point even if cleanup runs later.
- Only workspace owners can read named reports. The team export is aggregate only, and groups with fewer than five people show
insufficient contributors. - If the shared fields change, you have to consent again before new fields are sent.
Stop or delete
Two separate controls in Guard › Sessions:
- Stop sharing ends uploads and discards anything still queued. A machine with an old credential cannot keep reporting.
- Delete shared history removes your reports and the findings linked to them. Your usage and billing records stay.
On the machine, tallygraph security disable clears pending uploads and drops the credential.
Shadow mode
The first policy is the trifecta rule: once a session has touched private data and untrusted input, an action that can send data out needs approval. The order does not matter.
Every workspace starts in shadow mode: the policy is evaluated and the result is reported, but tools always run. Blocking (enforce mode) is only offered for agents whose interception has been verified end to end. No agent has passed that check yet, so today the product reports and does not block.
Offline audits
Without opting in to anything, tallygraph exposure, tallygraph trifecta and tallygraph scan run the same kind of checks locally and print the result. See the CLI reference.