Skip to content
Agent Archaeology

Agent Archaeology

Reconstruct what AI agents saw, decided, and did.
A practical field manual for agentic events, tool use, conversations, sessions, traces, and evidence.

Explore TelltaleStart the Field Manual

Why Agent Archaeology?

Agents now leave evidence across the whole workspace.

AI agents now operate across editors, terminals, browsers, filesystems, APIs, and internal tools. Their work can be useful, surprising, or risky. When an agentic event matters, teams need a practical way to reconstruct what happened: the prompt, the context, the tools, the actions, the outputs, and the evidence left behind.

What is an agentic event?

An agentic event is a bounded sequence where an AI agent receives context, makes choices, invokes tools or produces instructions, and leaves artifacts that can be preserved and reviewed.

Agent Evidence Sources

Six agent families, bounded source coverage

Telltale’s current source baseline covers eight exact source identities across these six families. Qwen CLI and OpenClaw are fixture-backed previews for live use.

  • Codex
  • OpenCode
  • Claude Code
  • GitHub Copilot
  • Qwen CLI
  • OpenClaw
6
Coding-agent families

Codex, Claude Code, OpenCode, Copilot, Qwen CLI, and OpenClaw

JSONL
Telemetry output

Redacted events for local review and SIEM forwarding

9
Detection & Telemetry Guides

Install, validation, inventory, rules, telemetry, schemas, and playbooks

10
Field Manuals

Traces, context, tools, MCP, sessions, boundaries, provenance, supply chain, playbooks, glossary

Agentic Forensics basics

Start with approachable artifacts before diving into product-specific telemetry.

Conversations

Prompts and responses show visible intent and context, but rarely capture the whole event.

Sessions

Session stores preserve continuity across prompts, tools, workspaces, and resumed runs.

Tools

Tool calls show how agents read, write, execute, query, browse, and cross trust boundaries.

Evidence and provenance

Keep the chain visible.

Agent evidence is often exported, normalized, redacted, summarized, and correlated. Preserve source artifacts, hash important records, and label the difference between observed facts and inferred intent.

Read about provenance

Telltale

Detection and telemetry for coding agents.

Telltale is an open-source detection and telemetry layer for AI coding agents and agentic development environments. It is a project hub here, not the whole field.

Explore Telltale

Resources

Curated guides and community knowledge.

Start with the Field Manual for stable guidance. Use the Knowledge Base for contributor notes, concrete examples, and checklists that expand the practice.

Field Manual

Curated canonical guides for traces, tool calls, session stores, MCP surfaces, and provenance.

Knowledge Base

Community-editable field notes, examples, checklists, and narrow observations.

Glossary

Shared language for agentic events, traces, sessions, MCP, provenance, and redaction.

Tool Calls

How agents read, write, execute, query, browse, and cross trust boundaries.

Schemas

Structured event and telemetry field guidance for searchable evidence.

Detection Catalog

Bundled Telltale rule IDs, targets, scores, chains, and caveats.

Source Validation

Which agent stores Telltale reads, and what evidence each one preserves.

Help build the knowledge base.

Contribute field notes, examples, workflows, checklists, and observations that help practitioners understand and investigate agentic systems.

Contribute Knowledge