Know when your agentgoes off track
trackline watches what coding agents and production agents actually do, and tells you, or the agent, the moment it stops matching what you asked.
Paste it into Claude Code, Codex or Cursor, and it installs and checks itself.
Claude
Codex
Your agent
Cursor
Production
traces
One set of rules for every agent you use
The problem
An agent that goes off task does not crash.
It edits files you never mentioned. It installs a package nobody asked for. It ignores the rules file it read an hour ago. A support agent changes a credit limit it was told never to touch. And the build stays green, because tests check that code does what it was written to do, not whether it is the code you asked for.
Nothing in the toolchain is watching for that. trackline is.
One engine, two places.
Beside a coding agent while it works, and over the traces of an agent in production.
It watches.Beside a coding agent, a hook sees every action before it runs. In production, it reads the traces your agent already sends.
hook
read README.mdon taskedit greet.json taskwrite .envblocked · off-limitsedit greet.json tasknpm install left-padnoted · new dependencybash npm teston taskedit billing/limits.tsnoted · scope
checked before it runs · ~14 ms
What you asked forrequest
AGENTS.mdrules file
Tool policyproduction
.envprotected path
It compares.Each action is checked against what you asked for, your rules files and a tool policy. Most checks are plain rules, not a model.
trackline [BLOCKED]
writing to a protected path: .env
do this instead: leave this file alone; if the change is genuinely needed, make it by hand
agent · I couldn't add API_KEY to .env. That path is protected, so you'll need to edit it yourself.
It tells you, or the agent.By default it only writes things down. You choose, check by check, whether it should also stop the agent and explain why, so the agent can correct itself.
What it catches. Six checks, and one question only a model can answer.
Off-limitsWrites to .env, keys, credentials, whatever you protect.
The checks are arithmetic and never guess. The judge is a model, measured before it was trusted, and off until you turn it on.
Where it works
One set of rules for every agent you use.
A vendor can govern its own agent. Only something that belongs to none of them can govern all of them the same way.
| Claude Code | Codex | Cursor | Any MCP client | Production traces | |
|---|---|---|---|---|---|
| Stops an action before it happens | yes | yes | yes | no, advises only | no, alerts after |
| Tells the agent why | yes | yes | yes | yes | no |
| Knows what you asked | yes | yes | yes | if the agent says | if content capture is on |
trackline doctor --host <name> prints the full list of what it can and cannot see in each.
The evidence
Every claim here was measured first.
Each was measured before it was built on. Where a result has limits, the write-up names them next to the number.
What it cannot do
Where it sees less.
Named plainly, because a tool that looks complete stops getting better.
- In production it alerts, it cannot stop.A trace is a record of what already happened.
- Production needs content capture on.Without it, a trace does not say which tool was called, and trackline reports that rather than guessing.
- Scope stays quiet when your request names no file.It will not invent a scope you did not state.
- Through MCP, the agent chooses whether to ask.An agent that does not ask is not watched.
- Production has not yet met real traffic.It was tested on a stream sent by the real OpenTelemetry libraries, with scripted conversations.
Install withone paste
Install trackline in this project for me. Instructions written for coding agents: https://trackline.dev/install.md Read them first if you can fetch URLs. If you cannot: 1. Run: npm install -g trackline (needs Node 20 or newer) 2. From the project root, run trackline init with the flag for the agent you are: Claude Code: trackline init Codex: trackline init --host codex Cursor: trackline init --host cursor 3. Run trackline doctor --host <claude|codex|cursor> and show me what it reports. Then tell me anything I have to do by hand. Do not use sudo, and do not change trackline's settings unless I ask.
Paste the prompt into your agent, or run the commands yourself. It starts in warn mode: it notices things and writes them down, and never interrupts you. Run trackline status after your agent's next edit to see that it fired.