AI Agent Frameworks: Forensic Artifact Reference

Comprehensive catalog of disk artifacts left by AI agent frameworks and assistant tools. Generated for DFIR collection tool development. All paths are default locations.

1. Hermes Agent

Type: AI assistant with MCP, skills, cron, memory
Platforms: Linux, macOS, Windows (WSL)

Configuration & Auth

Session & Conversation History

state.db Schema (key tables):

• sessions: id, source, user_id, model, system_prompt, started_at, ended_at, end_reason, message_count, tool_call_count, input/output/cache/reasoning tokens, billing_*, title, cwd, git_branch, git_repo_root, chat_id, chat_type, thread_id
• messages: id, session_id, role, content, tool_call_id, tool_calls, tool_name, timestamp, token_count, finish_reason, reasoning, reasoning_content, platform_message_id
• state_meta: key-value store
• compression_locks: session_id, holder, acquired_at, expires_at
• gateway_routing: scope, session_key, entry_json, updated_at
• messages_fts / messages_fts_trigram: Full-text search indexes

Memory & Skills

Cron & Automation

Logs

Other Artifacts

2. OpenClaw family (OpenClaw / Clawdbot / Moltbot / NanoClaw)

Type: Open source autonomous agent runtime
Platforms: Linux, macOS, Windows
Status: The project was renamed multiple times under trademark pressure — Clawdbot → Moltbot → OpenClaw — all within January 2026. NanoClaw is a lighter-weight variant of the same runtime. All four share the same underlying architecture and forensic surface, so a responder should treat them as one family and check for every name.

Rename history (all one project)

Known Artifacts

Forensic significance

OpenClaw is an always-on autonomous agent that executes shell commands, reads and writes files, browses, and acts across a user's accounts. Its gateway config, skills, and session state are the evidence of what the agent was told to do and what it did. The family has a dense incident record (CVE-2026-25253 one-click RCE, thousands of publicly reachable instances, a registry supply-chain campaign), so detecting any of the four names is a high-priority shadow-AI signal.

Detection

The TRACE Shadow AI meta-collector detects all four names (openclaw, clawdbot, moltbot, nanoclaw) by config path and CLI binary, flagging each as high risk.

3. AutoGPT

Type: Autonomous AI agent
Platforms: Linux, macOS, Windows

Configuration & Workspace

Memory & Persistence

Browser/Interaction Logs

• AutoGPT uses a local browser (Playwright) that may leave traces in ~/.browser/ or browser profile dirs.

4. BabyAGI

Type: Task-driven autonomous agent
Platforms: Python (cross-platform)

Configuration & Storage

Persistent Artifacts

• Default: BabyAGI stores tasks and objectives in-memory only during execution.
• With extensions: ChromaDB/Pinecone/Weaviate vector stores may be used at configured paths.
• ChromaDB default: chroma_db/ or chroma_db_data/ in project directory (SQLite + parquet files).
• No standard config directory — all config is via .env and command-line args.

5. CrewAI

Type: Multi-agent orchestration framework
Platforms: Python (cross-platform)

Configuration

Memory & Knowledge Storage

ChromaDB storage (used by CrewAI memory/knowledge):

• chroma.sqlite3 — vector metadata SQLite DB
• {collection_id}/data_level0.parquet — embedding vectors
• {collection_id}/metadata_level0.parquet — document metadata

CLI Artifacts

• crewai create crew scaffolding creates src/, knowledge/, memory/ directories.

6. LangChain / LangGraph

Type: Agent framework (library)
Platforms: Python/TypeScript (cross-platform)

Configuration

Checkpoint/State Storage (LangGraph)

LangGraph SQLite Checkpoint Schema:

• checkpoints table: thread_id, checkpoint_ns, checkpoint_id, parent_checkpoint_id, type, checkpoint (blob), metadata (JSON)
• checkpoint_writes table: thread_id, checkpoint_ns, checkpoint_id, task_id, idx, channel, type, value (blob)
• checkpoint_blobs table: thread_id, checkpoint_ns, channel, version, type, blob_data

LangSmith Traces (cloud, but may cache locally)

7. Microsoft AutoGen

Type: Multi-agent conversation framework
Platforms: Python/.NET (cross-platform)

Configuration

Cache & Memory

DiskCache format: Python diskcache library stores key-value pairs with metadata in SQLite (cache.db) plus blob files in a subdirectory structure.

.NET AutoGen Artifacts

8. OpenHands (formerly OpenDevin)

Type: AI software engineer
Platforms: Docker-based (server), Python

Configuration

Session & Conversation Storage

Workspace

• OpenHands runs code in Docker containers. Workspace files persist in Docker volumes.
• Local artifacts include the Docker volume mount at the configured workspace path.

9. Devin

Type: AI software engineer (closed-source/SaaS)
Platforms: Web-based

Local Artifacts

• Devin is primarily SaaS/cloud-based — minimal local artifacts.
• Browser history/cookies for app.devin.ai or devin.ai.
• If using CLI integration, check ~/.devin/ for any local config.
• Email/calendar integrations may leave OAuth tokens in browser storage.

10. Aider

Type: AI pair programming (terminal)
Platforms: Linux, macOS, Windows

Configuration & History

Key: Most Aider artifacts are project-local (in the git root of the project being edited), NOT in ~/.aider/.

API Keys

• OpenAI: OPENAI_API_KEY env var
• Anthropic: ANTHROPIC_API_KEY env var
• Other providers: Various env vars (no local key file storage by default)

Git Artifacts

• Aider creates commits with messages referencing aider.
• git log --author="aider" or git log --grep="aider" to find Aider commits.

11. Cursor

Type: AI code editor (fork of VS Code)
Platforms: Linux, macOS, Windows

Configuration & Storage

AI-Specific Artifacts

macOS-Specific

12. Claude Code

Type: Anthropic CLI agent
Platforms: Linux, macOS, Windows (WSL)

Configuration & Memory

Session & Conversation

API Keys

• ANTHROPIC_API_KEY env var
• OAuth tokens in ~/.claude/credentials.json
• If using third-party providers: keys in env vars or ~/.claude/config.json

13. Codex CLI (OpenAI)

Type: OpenAI CLI agent
Platforms: Linux, macOS, Windows (WSL)

Configuration & Auth

Session & History

API Keys

• OPENAI_API_KEY env var
• OAuth tokens in ~/.codex/auth.json
• ChatGPT device flow tokens (access_token, refresh_token)

14. Warp

Type: AI terminal emulator
Platforms: macOS, Linux

Configuration & Storage

Key Artifacts

• warp_history.db — SQLite database with full command history, timestamps, working directory, exit code.
• AI conversations stored as JSON with prompt/response pairs.
• Terminal recordings (if enabled) stored in data directory.

15. GitHub Copilot

Type: AI code assistant (VS Code / JetBrains extension)
Platforms: Linux, macOS, Windows

VS Code Extension Storage

Auth & OAuth

Copilot CLI

16. Continue

Type: Open-source AI code assistant
Platforms: Linux, macOS, Windows (VS Code / JetBrains)

Configuration

Sessions & History

API Keys

• Stored in ~/.continue/config.json or config.yaml (provider API keys)
• Or via environment variables (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.)

17. Cline

Type: VS Code AI extension (autonomous coding)
Platforms: Linux, macOS, Windows

Configuration & Storage

Workspace-Local

macOS Documents Path

18. Amp (Sourcegraph)

Type: AI coding agent
Platforms: CLI, VS Code extension

Configuration & Storage

Note: Amp is relatively new (2025) and artifact locations may evolve. The ~/.amp/ directory is the primary forensic target.

19. Jupyter AI

Type: Jupyter AI assistant
Platforms: Python/Jupyter (cross-platform)

Configuration

Chat History

• Jupyter AI chat history is stored in the browser (localStorage/IndexedDB in JupyterLab frontend).
• No server-side chat persistence by default.
• Server logs may contain AI request metadata in Jupyter server logs.

API Keys

• OPENAI_API_KEY, ANTHROPIC_API_KEY, etc. in env vars
• Or configured in jupyter_ai_config.py/jupyter_server_config.py

20. Shell-GPT (sgpt)

Type: CLI AI assistant
Platforms: Linux, macOS, Windows

Configuration & Storage

Chat Cache (ephemeral by default)

Config format (.sgptrc):

OPENAI_API_KEY=sk-...
DEFAULT_MODEL=gpt-4o
CHAT_CACHE_LENGTH=100
CHAT_CACHE_PATH=/tmp/chat_cache
CACHE_LENGTH=100
CACHE_PATH=/tmp/cache
ROLE_STORAGE_PATH=~/.config/shell_gpt/roles
DEFAULT_COLOR=magenta

Key: Chat cache is in /tmp/ by default and is ephemeral — cleared on reboot. The config file stores the API key in plaintext.

Cross-Tool Forensic Patterns

API Key Locations Summary

Session/Conversation Storage Summary

Shell History Artifacts

Tools that add entries to shell history (.bash_history, .zsh_history, .python_history):

• Hermes Agent: ~/.hermes/.hermes_history
• Aider: .aider.input.history (per project)
• Shell-GPT: Regular shell history entries (commands starting with sgpt)
• AutoGPT: Regular shell history entries
• BabyAGI: Regular shell history entries
• Warp: Own SQLite history DB (also writes to shell history)
• Codex CLI: Regular shell history entries

Forensic Collection Priority (High-Value Targets)

Tier 1 — Most forensically rich:

1. Hermes Agent: ~/.hermes/ (SQLite DB with full conversation + billing, JSONL sessions, memory files, cron, auth tokens, logs)
2. Cline: ~/.cline/ (SQLite sessions, task history with full API conversations, secrets)
3. Claude Code: ~/.claude/ (credentials, project state, session data)
4. Continue: ~/.continue/ (sessions, config with API keys, codebase index)

Tier 2 — Rich but more limited: 5. Cursor: ~/.cursor/ (workspace storage, AI configs) 6. Warp: ~/.warp/ + warp_history.db (full command history) 7. Aider: Project-local .aider.* files (chat history, LLM history) 8. Codex CLI: ~/.codex/ (auth, config, skills)

Tier 3 — Config-focused or ephemeral: 9. Shell-GPT: ~/.config/shell_gpt/ (config with API key, roles; chat cache is ephemeral) 10. GitHub Copilot: Extension storage, hosts.json (OAuth tokens) 11. CrewAI: Project-local ChromaDB files (memory/knowledge) 12. LangGraph: checkpoints.sqlite (configurable location) 13. Jupyter AI: Browser-only chat, server config for API keys

Collection Commands (Linux/macOS)

# Hermes Agent
find ~/.hermes/ -type f 2>/dev/null

# Claude Code  
find ~/.claude/ -type f 2>/dev/null
find / -maxdepth 5 -name "CLAUDE.md" -o -name ".claude" -type d 2>/dev/null

# Cline
find ~/.cline/ -type f 2>/dev/null
find ~/.cursor/ -path "*/cline/*" -type f 2>/dev/null

# Continue
find ~/.continue/ -type f 2>/dev/null

# Aider (project-local)
find / -maxdepth 5 -name ".aider.chat.history.md" -o -name ".aider.llm.history" -o -name ".aider.input.history" 2>/dev/null

# Shell-GPT
find ~/.config/shell_gpt/ -type f 2>/dev/null
find /tmp/chat_cache/ /tmp/cache/ -type f 2>/dev/null

# Cursor
find ~/.cursor/ -type f -name "*.json" 2>/dev/null

# Warp
find ~/.warp/ -type f 2>/dev/null
find ~/Library/Application\ Support/dev.warp.Warp-Stable/ -type f 2>/dev/null  # macOS

# GitHub Copilot
find ~/.config/github-copilot/ -type f 2>/dev-dev/null
find ~/Library/Application\ Support/GitHub\ Copilot/ -type f 2>/dev/null  # macOS

# Codex CLI
find ~/.codex/ -type f 2>/dev/null

# AutoGPT
find ~/.autogpt/ -type f 2>/dev/null
find / -maxdepth 5 -name "ai_settings.yaml" -o -name "auto_gpt_workspace" -type d 2>/dev/null

# CrewAI (project-local)
find / -maxdepth 5 -name "chroma.sqlite3" -path "*/crewai/*" 2>/dev/null

# LangGraph
find / -maxdepth 5 -name "checkpoints.sqlite" 2>/dev/null

Windows-Specific Paths