Local-first by design
Everything Replay records is stored on your machine in a single file. No accounts, no cloud, no telemetry you didn't ask for.
AI Detection & Response
Watch your AI agents
like you'd watch a network.
Replay watches what your AI agents do: the commands, files, and URLs they touch. Detection rules run locally, sessions rebuild from saved history, and you can opt into blocking per rule.
Free and local-first. Nothing leaves your machine unless you say so.
live record stream tailing
●record_type=event · event_type=command.exec · tool=run_command
●observable=url · value=http://169.254.169.254/latest/meta-data/
●finding=recon.cloud_metadata · severity=medium · agent=claude
●threat-intel · no match · feed=Threat Landscape
▍awaiting next hook event…
How it works
Built for the way agents work.
Replay sits between the agent and the system: it watches and records, and only blocks when you opt in.
Always-on protection
Monitoring keeps running even when the app is closed, so nothing slips through while you're away.
Detection rules
A built-in rule catalog, plus your own policy, runs locally against every action. Opt into blocking per rule, or stay monitor-only.
Session replay
Alerts reconstruct into full session timelines: every tool call, command, and file touched, in order.
Threat-intel correlation
Observed domains, IPs, URLs, and hashes are matched against the Threat Landscape feed and surfaced as enriched alerts.
Verify your wiring
Wired doesn't mean working. A per-agent self-test confirms the connector really sends records, and a staleness flag catches silent failures.
Download
Free and local.
The binary includes the interface and the detection engine, so one tarball is all you need. No accounts, no installers that phone home.
Linux
x86_64requires libwebkit2gtk-4.1 + libgtk-3 runtime
↓ download tarball
Windows
x86_64single .exe, self-contained
↓ download tarball
macOS
Apple Siliconarm64 (Intel Macs: check back)
↓ download tarball
install & runtar -xzf replay-linux-amd64-0.1.0.tar.gz && ./replay
The app checks /replay/latest.json for new versions and surfaces them in Settings → Updates.
Enterprise
Central visibility, without surrendering the local engine.
The free app stays fully local. The enterprise tier adds managed services on top: same engine, central control.
coming soon
Managed analytics
Central visibility over agent activity across every installation: alerts, observables, enforcement, and events, redaction-first.
Orchestration
Distribute operator policy centrally, assign per team or host, and audit which rule/version was effective, where, and when.