Developer integration

Observe coding agents without changing their runtime.

DriftGard Agent Observer tails local coding-agent sessions and sends prompt, response, metadata, and optional tool-call evaluations to DriftGard for audit, DLP, and policy tuning.

View npm package See Tool Governance

Supported surfaces

Start in observe mode for developer workstations and teams.

CodexPrompt, response, metadata, and function/tool calls.

Claude Code, Kiro, Copilot, CursorSession reconstruction from persisted local files where available.

JSONL exportsStable fallback for tools with custom transcript export.

Install

One npm package for local agent visibility.

Use it as a foreground process during testing or install it as a background service for teams.

npm install -g @driftgard/agent-observer

driftgard-agent-observer --agent all --config ~/.driftgard/agent-observer.json

Capture

Collect prompt and response turns from supported local coding-agent session stores.

Evaluate tools

Send terminal commands and other supported tool calls as first-class DriftGard tool-call evaluations.

Route by workspace

Map each repo or workspace to the right DriftGard project, developer identity, and coding-agent role.

Configuration

Multi-project routing for real developer teams.

{
  "base_url": "https://api.driftgard.com",
  "api_key": "dg_project_key",
  "default_project_id": "proj_default",
  "on_unmatched_workspace": "skip",
  "include_tool_calls": true,
  "evaluate_tool_calls": true,
  "redact_secrets": true,
  "dev_name": "Demo User",
  "dev_email": "demo@example.com",
  "projects": [
    {
      "name": "Backend",
      "workspace": "/Users/demo/git/backend",
      "project_id": "proj_backend",
      "agent_role": "coding_agent",
      "model_id": "coding-agent"
    },
    {
      "name": "Frontend",
      "workspace": "/Users/demo/git/frontend",
      "project_id": "proj_frontend",
      "agent_role": "coding_agent",
      "model_id": "coding-agent"
    }
  ]
}

Tool-call routing: tool calls route by the tool working directory, such as tool_call.parameters.workdir. If on_unmatched_workspace is skip, commands outside configured workspaces are not sent to DriftGard.

DLP behavior

Choose local redaction or centralized DriftGard enforcement.

Setting	What happens	Use when
`redact_secrets: true`	The observer redacts secret-like values locally before sending events.	Default for real developer workstations and privacy-first teams.
`redact_secrets: false`	DriftGard receives the raw value, evaluates it against the active Control Pack, and can block/redact using `block_on_secrets`.	Demos, controlled tests, or centralized DLP enforcement.

Do not test with real secrets. Use fake canary values only.

printf '%s\n' 'OPENAI_API_KEY=sk-proj-test_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'

Boundary

Observer first, inline enforcement later.

Agent Observer records and evaluates local agent activity. It does not stop a local tool call after the coding tool has already emitted it. Use it for visibility, audit, DLP tuning, and Control Pack testing. Inline blocking requires an agent hook or routing sensitive actions through a DriftGard-controlled service.

Coding agent->Agent Observer->DriftGard evaluation + evidence

Bring coding agents into your governance trail.

Start with observe mode, capture tool-call evidence, and tune Control Packs before introducing inline enforcement.

Book demo