Summary
Telemetry
Anonymous usage analytics: adapter names, enum values (risk tier, agent type, action), counts, durations, rounded scores and coarse environment tags such as the Python version and whether the process runs in CI. Never prompts, model inputs or outputs, tool arguments, file paths, agent names or exception messages. Every event and property is listed on the Telemetry page, and every payload is built in one file,_telemetry_props.py.
A random UUID stored at ~/.agentegrity/id is the only identifier. Nothing is sent on import.
Turn off: set DO_NOT_TRACK=1 or AGENTEGRITY_TELEMETRY_DISABLED=1, or call agentegrity.disable_telemetry(). When disabled, no ID file is created, no thread starts and no network is used. AGENTEGRITY_TELEMETRY_DISABLE_GEOIP=1 keeps telemetry but asks PostHog to skip geographic enrichment.
The TypeScript packages send no telemetry.
Exporters you attach
Exporters receive everything the adapter sees. Eventdata is the payload the framework handed the adapter, so it includes prompts, tool arguments, tool output and, on pre_compact, the reasoning and tool output being compacted away. See Events and wire format.
HTTPExporter posts every payload to a backend such as Agentegrity Pro. It attaches in two ways:
- In code, with
register_exporter(HTTPExporter(url, token)). - From the environment: when
AGENTEGRITY_TOKENandAGENTEGRITY_EXPORTER_URL(or its aliasAGENTEGRITY_URL) are both set, every Python adapter attaches one at construction. This includes adapters built by the coding-agent hook daemon.
stream_from_env=False to an adapter class, to keep the environment from attaching one. The URL must be HTTPS or a loopback address: HTTPExporter raises ValueError for any other, and the environment path attaches nothing and logs a warning. The token is sent as a Bearer header, and redirects are not followed, so it goes only to the configured origin.
OTelSessionExporter writes spans and metrics through your OpenTelemetry providers; where they go is set by your OpenTelemetry configuration. Span attributes carry scores, actions, layer names, tool names and 16-character SHA-256 prefixes of content. Raw content is added only with capture_content=True, as span events truncated to 512 characters. See OpenTelemetry.
Custom exporters receive the same full payloads and send them wherever their code does.
Alert sinks
WebhookAlertExporter and SlackAlertExporter post to the URL you give them, only for verdicts in their alert_on set (block and escalate by default). The body carries the session id, adapter, event type, action, composite score, failing layer names, tool name and timestamp. Prompts, tool arguments and tool output are never included. See Webhook and Slack alerts, including the 0.12.0 limitation on registering them with an adapter.
Model-backed layers
These layers send content to a model to classify it. You turn them on by constructing them; the default layers never call a model.
All three call their model only on the async path:
await layer.aevaluate(...), IntegrityEvaluator.aevaluate() or an AsyncIntegrityEvaluator. Synchronous evaluate() runs only the pattern checks. Inside an adapter, the async path runs at every tool-call gate, so an adapter built with AdversarialLLMLayer or AdversarialSLMLayer sends the content above at each tool call, once per distinct piece of text. CorticalLLMLayer sends nothing from inside an adapter, because adapters do not capture the reasoning chain, memory reads or behavior descriptions it checks. The SLM layer makes no calls when no model name is configured.
KMS checkpoints
KMSCheckpoint (pip install "agentegrity[kms]") encrypts recovery checkpoints with a data key from AWS KMS. It calls GenerateDataKey on save and Decrypt on load. Snapshot content is encrypted locally with AES-GCM and stored through the inner checkpoint backend; KMS receives the key id, the optional encryption context and the wrapped data key, never the snapshot.
The agentegrity pro command
agentegrity pro refuses a URL that is neither HTTPS nor loopback, then sends GET <url>/ingest/verify with your token to check it without following redirects, then, if you pass a command, runs it with streaming turned on. See CLI.
TypeScript client
Every@agentegrity/<framework> package sends each session through the built-in reporter to AGENTEGRITY_URL, and sends nothing when it is unset. The URL must be HTTPS or a loopback address; any other URL is refused and nothing is sent. The payloads are the same full-content exporter payloads, without integrity scores, because the TypeScript packages do not evaluate. Redirects are refused, so the token in AGENTEGRITY_TOKEN goes only to the configured origin.
Turn off: leave AGENTEGRITY_URL unset, set AGENTEGRITY_OFFLINE=1 to skip requests while keeping exporters you registered, or set AGENTEGRITY_DISABLED=1 to turn the adapter off.
Checking a session
The session summary names every exporter attached to the adapter:type and, for sinks with a nameable destination, a target origin. Alert sink targets have their query string removed. Neither the summary nor the INFO log line written when the HTTP exporter attaches contains a token.
An empty exporters list means no exporter was attached to that adapter. It does not cover telemetry, model-backed layers or KMSCheckpoint, which are configured separately, and the TypeScript summary has no exporters field.
Written to local disk
These stay on the machine but outlive the process:~/.agentegrity/id, the telemetry ID (only while telemetry is on).~/.agentegrity/<host>/(orAGENTEGRITY_HOOK_DIR), the coding-agent hook runtime’s decision chains (written with mode0600), token-usage state and behavioral baselines.- Any
FileCheckpoint,FileBaselineStoreor SQLite store you configure.
AttestationChain.to_json() if you need them.