Show HN: Logira – eBPF runtime auditing for AI agent runs

AI agents get a spy cam; fans cheer while skeptics roast the curl | bash install

TLDR: Logira records exactly what AI agents do on your computer, flagging risky behavior without blocking it. The community loves the audit trail but debates self-auditing and roasts the curl | bash installer, asking for smarter reviews and safer defaults to keep “robot coders” from going rogue.

Meet logira, the “spy cam” for your AI helpers: it quietly records what an agent actually runs, edits, and connects to on your machine using eBPF (a Linux tech for peeking at system activity). It’s observe-only, building a per-run timeline and flagging sketchy moves like grabbing secrets, nuking files, or phoning weird ports. The crowd loves the idea of a trustworthy trail that doesn’t depend on the agent’s own story. But then the drama: a top comment suggests letting the agent review its own log—cue memes about “the fox auditing the henhouse.”

Key Points

  • Logira is an observe-only Linux CLI that uses eBPF to record process, file, and network events for AI agent and automation runs.
  • It attributes events to individual runs using cgroup v2 and stores per-run data locally in JSONL and SQLite for review and querying.
  • The tool includes default detection rules and supports custom YAML rules, focusing on credentials, persistence, suspicious exec patterns, destructive commands, and network egress.
  • Logira aims to provide a trustworthy execution trail independent of AI agents’ textual narratives and does not enforce or block actions.
  • Installation is available via a curl script, manual tarball, or from source, with a root daemon (logirad) runnable under systemd.

Hottest takes

“Give the log to the agent and let it review itself” — cadamsdotcom
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.