What is tracewall?

Tracewall is a local security tool that watches everything an AI coding agent does, such as Claude Code, and can stop it from leaking your private data. It works by recording every single tool call the agent makes, things like reading a file, running a shell command, or fetching a web page, and it keeps track of a dangerous combination of events across a whole session called the lethal trifecta: the agent has read private data, it has also been exposed to untrusted content such as a web page, and it now tries to send data somewhere outside the machine. When all three line up, tracewall can block the action before it happens, since that pattern usually means a prompt injection has tricked the agent into stealing information. It installs with a simple pip install and then wires itself into Claude Code's settings so every session gets recorded automatically to a local folder, with no cloud account and no extra dependencies needed. By default it only warns, called audit mode, but a single command switches it into enforce mode so it actually blocks risky actions instead of just logging them. There are three strictness profiles: standard, which mainly cares about sensitive files like SSH keys and only blocks the full trifecta pattern, strict, which treats any file read as potentially private, and paranoid, which blocks almost any outgoing connection once private data has been touched at all. Beyond the basic hook, tracewall includes an optional network proxy that inspects the agent's actual outgoing web traffic rather than just guessing from the command text, and a separate proxy for the Model Context Protocol so the same protection can apply to other AI agent tools beyond Claude Code, not only Claude specific ones. The project is upfront that this proxy layer only catches traffic that respects standard proxy settings, and that some low level tricks could still slip past it. Once installed, commands let you replay a recorded session in the terminal, export it as a shareable HTML report, or run a built in demo that stages a fake attack so you can see the blocking in action. It is written in Python, requires Python 3.10 or newer, and is released under the MIT license.