Credentials in cleartext
Provider keys sit unencrypted in editor state stores, cache directories and dotfiles — readable by any process running as that user, and pasted straight into chats.
v1.0.1 · AGPL-3.0 · by IONSEC
Leave nomodel untraced.
Your endpoints are running AI tools nobody approved — holding plaintext provider keys, unbounded agent tooling, and conversations full of pasted secrets. TRACE collects that evidence forensically, analyzes it, and hands you a report you can put in a case file.
Read-only collection · SHA-256 per artifact · chain of custody · no agent, no server
0
Platform collectors
0
Secret rules
0
Velociraptor artifacts
0
Report formats
The problem
Shadow AI is already on your endpoints
It arrived through developers, not procurement. It reads your source, runs your shell, and talks to a vendor over TLS. When something goes wrong, there is no log to pull — the evidence sits in dotfiles, SQLite stores and session transcripts.
Agents with a shell
Coding agents execute tool calls against the filesystem with roots far wider than the project — and the only record of what ran is a transcript nobody is collecting.
Inference on the LAN
Local model runtimes bind to every interface with no authentication, and containers publish them on the host network — a free inference endpoint for anyone on the segment.
Capabilities
Everything an investigation needs, in one sweep
TRACE is not a scanner that prints a list. It builds a case: hashed artifacts, a unified timeline, mapped techniques, and prioritized actions an analyst can act on today.
27 platform collectors
Inference runtimes, agent frameworks, AI dev tools and cloud caches — plus a shadow-AI sweep covering 47 more tools by their on-disk footprint.
103-rule secret detection
Provider keys, cloud credentials, tokens and private keys — with entropy gating, path confidence and allowlists. Raw values never leave the detector, only redacted previews.
Conversation forensics
Reconstructed sessions with jailbreak, prompt-injection, credential-harvesting and exfiltration patterns — plus which turn leaked a secret, and in which direction.
Unified timeline
Every artifact, prompt and tool call on one clock, with collection events marked so they can never be mistaken for user activity.
MITRE ATLAS & ATT&CK
Findings mapped to ATLAS techniques and the ATT&CK techniques they imply, so your AI incident lands in the same language as the rest of your program.
Kill chain & risk scoring
Which of the seven stages the evidence supports, a 0–100 score across eight weighted categories, and the five actions worth doing first.
HTML · JSON · STIX 2.1
A dark, JavaScript-free HTML report that prints as-is, machine-readable JSON for your pipeline, and a STIX bundle for your threat-intel platform.
Chain of custody
Read-only collection, SHA-256 per artifact, UTC timestamps and a manifest — evidence that survives review.
DFIR-IRIS integration
Push the whole case — assets, IOCs, timeline events, notes and tasks — straight into your IRIS instance in one command.
How it works
Four commands, start to case file
Run it on the endpoint or push it fleet-wide. Nothing is installed, nothing is modified, nothing phones home.
Discover
Find every AI platform and shadow-AI tool present, by artifact root and binary.
trace discover
Collect
Copy analyst-parseable artifacts read-only, hash each one, write the custody manifest.
trace collect -o /evidence --deep
Analyze
Extract IOCs and secrets, rebuild conversations, map techniques, score the risk.
trace analyze /evidence --secret-hunt
Report
Produce the HTML case report, the JSON record and the STIX bundle.
trace report /evidence --format all
The deliverable
A report you can hand to the case
Fifteen tabs of evidence — executive summary, attack surface map, findings, IOCs, timeline, MITRE, kill chain, actions, narratives, correlations, conversations, secret hunt, risk, evidence manifest and appendices. No JavaScript required to read it, and it prints cleanly.
Deployment
One tool, three ways to run it
The Python CLI and the Go binary have near-identical capabilities over one forensic data model, so evidence from either is interchangeable — and Velociraptor takes both across the fleet. The one exception: the Go binary collects SQLite conversation stores but does not parse them.
Python CLI
Install from PyPI and run anywhere Python 3.11+ is available. Ideal for analyst workstations and lab triage.
Single Go binary
One pure-Go dependency, cross-compiled for macOS, Linux and Windows on amd64 and arm64. Drop it on a host with no runtime to install.
Velociraptor fleet
15 VQL artifacts hunt AI tooling across every endpoint from your existing server — including artifacts that fetch and run the binary itself.
| Capability | Python CLI | Go binary |
|---|---|---|
| 27 collectors + 47 shadow-AI tool detections | ✓ | ✓ |
| Curated collection + chain of custody | ✓ | ✓ |
| IOC extraction & 103-rule secret detection | ✓ | ✓ |
| Conversation forensics & secret hunt | ✓ | ✓ |
| MITRE ATLAS & ATT&CK, kill chain, risk scoring | ✓ | ✓ |
| HTML · JSON · STIX 2.1 reports | ✓ | ✓ |
| DFIR-IRIS case push | ✓ | ✓ |
Quick start
Sweep an endpoint in under a minute
Python CLI
$ pip install ionsec-trace
$ trace discover
$ trace collect -o /evidence --deep
$ trace analyze /evidence --secret-hunt
$ trace report /evidence --format all
# → report.html · report.json · report.stix.json
Go binary — no Python
# download from the GitHub release, then:
$ ./trace run -o /evidence
# discover → collect → analyze → reports
$ ./trace iris /evidence \
--host https://iris.example.com
# → case pushed to DFIR-IRIS
Work with us
Found something you can’t explain?
IONSEC is a DFIR company. We built TRACE for our own investigations, and we run those investigations for other people too — when an agent did something nobody authorized, when a key turns up in a transcript, or when you simply need to know what AI is doing on your estate before it becomes an incident.
- Incident responseWe take the evidence you have — or collect it with you — and reconstruct what the AI tooling actually did.
- AI risk assessmentA TRACE sweep across your estate, read as a report: what is deployed, what is exposed, and what to fix first.
- Custom collectorsRunning a platform TRACE doesn’t cover yet? We’ll write the collector and upstream it.
FAQ
Questions we get asked
Does TRACE change anything on the endpoint?
No. Collection is read-only: TRACE reads artifacts, hashes them with SHA-256, and writes only into the evidence directory you name. No agent is installed, no service is registered, no configuration is modified, and nothing is sent anywhere.
Will it expose the secrets it finds?
No. The secret detector emits only redacted previews and a salted fingerprint — raw credential values never reach a report, a log or the JSON output. That is how the same secret can be counted once across a case without ever being stored.
What is the difference between the Python CLI and the Go binary?
In capability, near-identical — both implement the same platform catalog, secret rules, analyzers and report formats over the same data model. The one exception: the Go binary collects SQLite conversation stores but does not parse them, so use the Python CLI when you need SQLite conversation parsing. Choose Python when a runtime is already there; choose the Go binary when you want one file to drop on a host, or when you are pushing it fleet-wide with Velociraptor.
Can I run it across a whole fleet?
Yes. TRACE ships 15 Velociraptor artifacts, including
TRACE.AI.Binary.Linux, .macOS and .Windows, which fetch and run the binary on each endpoint and return the results to your existing Velociraptor server. No new infrastructure.How does it fit an existing DFIR workflow?
The JSON report is machine-readable for your pipeline, the STIX 2.1 bundle imports into a threat-intel platform, and
trace iris pushes assets, IOCs, timeline events, notes and tasks straight into a DFIR-IRIS case.What does it cost?
TRACE is free and open source under AGPL-3.0-or-later. IONSEC offers paid investigations, assessments and custom collector work on top of it — that is the part you talk to us about.