Agent Ledger
A work-in-progress record of what AI agents do in your browser. It runs on your Mac, watches Claude Code and Codex in your everyday Chrome, and writes down what actually happened and who did it, instead of trusting the agents' own summaries.
Work in progress. This is an early personal project. Version 0.1.0 records Claude Code and Codex reliably on the test site I built for it, and real sites come next. Expect gaps, rough edges and labels that change as detection improves. The Chrome extension is still in Chrome Web Store review.
The problem
AI agents now do real work in the browser you're signed in to. Claude Code works through Claude in Chrome, and Codex through the ChatGPT app. They edit records, fill in forms, send messages and change settings, all with your accounts.
When a task is done, the main account of what happened is the agent's own summary. It's written by the thing being reviewed, it leaves out whatever the agent didn't think mattered, and it sounds just as confident when it's wrong. If something changed that you didn't ask for, or a change you asked for didn't save, you find out later, if at all.
It's also hard to say who did what. You and an agent often share a tab: you sign in, it edits, you fix a field. And an agent has more than one way into your browser: its own extension, shell commands, automation tools that start their own Chrome, or control of the whole screen. Each agent's history covers only its own path, and an agent that can run commands on your Mac can also edit a log stored there.
What I'm building
An independent observer that sits beside the agents rather than inside them. A Chrome extension watches what actually happens in the tabs agents use. A Mac app adds what the browser can't see, such as which agent processes are running and whether a click came from your hand. Optional logging-only hooks add each agent's own report of its tool calls, kept apart from what was observed.
Every action gets a label and the reasons behind it. When the recorder isn't sure, it says so, and when it couldn't see something, it records a gap instead of implying it saw everything. The longer-term goal is independent observability for agents: a trustworthy audit trail first, then alerts when something looks off.
Where it stands
- Works today
- Version 0.1.0 records Claude Code and Codex in the tabs they use, including tabs you already had open: field changes, form submits, save requests and the page's own messages, each labeled with who did it. It's tested end to end on a test site, and testing on real sites comes next.
- Built, not released
- Coverage of the other ways agents reach Chrome: shell commands that open URLs or script Chrome, browser-automation tools such as Playwright, computer use, and separate Chrome processes an agent starts. It's tested with Claude Code and Codex and planned for the next update.
- Next
- A record agents can read but can't change, firmer attribution for Codex, and a short list of each session's consequential actions, such as sends, deletes, payments and shares, with the account used. Alerts come after that.
- Not planned yet
- Screenshots or video replay, cloud storage, and browsers other than Chrome. It runs only on macOS.
What it records today
- Navigation
- Pages an agent opens, with tokens and other sensitive URL parameters removed
- Interactions
- Clicks, typing, key presses and pastes, each with a short description of the element involved
- Field values
- Each field's value before and after a change, and every field at submit. Passwords, card numbers, one-time codes and hidden fields are never read
- Requests
- Requests that change data, with their status codes. Never request or response bodies
- Page messages
- Status and alert text such as "Saved" or a validation error
- Agent reports
- Each browser tool call the agent reports through its hooks, kept apart from what the browser observed
Reading a page or taking a screenshot leaves no browser event, so the record says when it couldn't see something instead of implying it saw everything.
Who did what
Every action gets a label and the reasons for it. Identified means the agent reported that operation on that tab at that moment. Likely means it was inferred, for example from the agent controlling the tab. Likely you means a physical click or key press happened right then while Chrome was in front. Mixed means both did. Unknown actor means nothing matched.
Claude Code reports the tab of each browser action, so its work is usually Identified. Codex reports its browser calls but not their tabs, so its work shows as Likely Codex.
Privacy and limits
Everything stays on your Mac. The extension talks only to the Agent Ledger app on the same computer, and nothing is sent to me or to any server. There's no account and no analytics.
Ordinary browsing is kept in memory for a few minutes and never written to disk. Only agent sessions are recorded, in an append-only, hash-chained local database that shows whether it has been edited. It can't stop a program that rewrites the whole file.
Try the early version
It's free and open source, and it will change quickly.
- Download the Mac app from GitHub and drag it to Applications. It's signed, notarized and updates itself.
- Add the Agent Ledger extension to Chrome. The Chrome Web Store listing is in review; until then, load the copy the app installs, as the support page explains.
- Optionally turn on the logging-only hooks for Claude Code and Codex in Settings → Integrations. They never block or change what the agent does.
macOS 14 or later, Google Chrome, and Claude Code with Claude in Chrome or Codex in the ChatGPT app.
Feedback
If you try it, I'd like to hear what it caught, what it missed and what it got wrong.