Skip to content
Agent Archaeology

Agent Archaeology

Reconstruct what AI agents saw, decided, and did.
A practical field manual for agentic events, tool use, conversations, sessions, traces, and evidence.

Explore Telltale Start the Field Manual

Why Agent Archaeology?

Agents now leave evidence across the whole workspace.

AI agents now operate across editors, terminals, browsers, filesystems, APIs, and internal tools. Their work can be useful, surprising, or risky. When an agentic event matters, teams need a practical way to reconstruct what happened: the prompt, the context, the tools, the actions, the outputs, and the evidence left behind.

What is an agentic event?

An agentic event is a bounded sequence where an AI agent receives context, makes choices, invokes tools or produces instructions, and leaves artifacts that can be preserved and reviewed.

Agent Evidence Sources

Supported coding-agent traces

Telltale and the field manual focus on the agents that leave forensic evidence in session stores, tool logs, and workspace artifacts.

  • Codex
  • OpenCode
  • Claude Code
  • GitHub Copilot
  • Gemini CLI
  • Qwen CLI
  • RooCode
  • KiloCode
  • OpenClaw
9
Supported Agents

Codex, OpenCode, Claude Code, Copilot, Gemini CLI, and more

13
Detection Categories

Secret access, execution, exfiltration, MCP injection, supply chain, and more

9
Detection & Telemetry Guides

Install, validation, inventory, rules, telemetry, schemas, and playbooks

8
Field Manuals

Traces, tools, MCP, sessions, boundaries, provenance, supply chain, glossary

Agentic Forensics basics

Start with approachable artifacts before diving into product-specific telemetry.

Conversations

Prompts and responses show visible intent and context, but rarely capture the whole event.

Sessions

Session stores preserve continuity across prompts, tools, workspaces, and resumed runs.

Tools

Tool calls show how agents read, write, execute, query, browse, and cross trust boundaries.

Evidence and provenance

Keep the chain visible.

Agent evidence is often exported, normalized, redacted, summarized, and correlated. Preserve source artifacts, hash important records, and label the difference between observed facts and inferred intent.

Read about provenance

Telltale

Detection and telemetry for coding agents.

Telltale is an open-source detection and telemetry layer for AI coding agents and agentic development environments. It is a project hub here, not the whole field.

Explore Telltale

Resources

Curated guides and community knowledge.

Start with the Field Manual for stable guidance. Use the Knowledge Base for contributor notes, concrete examples, and checklists that expand the practice.

Field Manual

Curated canonical guides for traces, tool calls, session stores, MCP surfaces, and provenance.

Knowledge Base

Community-editable field notes, examples, checklists, and narrow observations.

Glossary

Shared language for agentic events, traces, sessions, MCP, provenance, and redaction.

Tool Calls

How agents read, write, execute, query, browse, and cross trust boundaries.

Schemas

Structured event and telemetry field guidance for searchable evidence.

Detection Catalog

Bundled Telltale rule IDs, targets, scores, chains, and caveats.

Source Validation

Harness coverage, session formats, validation status, and lossy fields.

Help build the knowledge base.

Contribute field notes, examples, workflows, checklists, and observations that help practitioners understand and investigate agentic systems.

Contribute Knowledge