Actualis

What actually ran.

Actualis reads the logs your coding agents already write, and turns them into clear answers about exposure, activity and cost. No agent to install, nothing sitting between you and your tools, nothing leaving the machine.

Local — runs on your machine Read-only — never writes to your logs No network — makes no outbound calls
Get Actualis See what it answers

AGPL-3.0 · macOS, Linux, Windows · Python standard library only

actualis — run summary
$ actualis --days 30

EXPOSURE
  20 critical credentials in agent context
  54 distinct secrets seen · oldest 37 days

ACTIVITY
  4,812 commands actually executed
     9 flagged for review

COST
  $418.22 across 6 projects
  cache hit rate 71% · $1.34 median per ticket

Illustrative output. Your figures come from your own logs.

What it answers

Three questions your agent logs can already answer

They are just not in a form you can read. Actualis does the reading.

Exposure 20 critical credentials

What secrets reached the model

API keys, tokens and service credentials that were pasted into a prompt, printed by a command, or read out of a file. Grouped by fingerprint, with first seen, last seen, how many times it was used, and which projects.

Activity 4,812 commands executed

What the agent actually did

Every shell command that really ran, not what was proposed. Destructive commands, and commands that reach the network, are listed separately, with the permission mode in force at the time and every denial recorded.

Cost $418 across 6 projects

What it cost, and where

Token spend by project, branch, model and ticket, with cache read and write priced separately. Subagent usage is attributed to the run that spawned it rather than lost in the total.

How it works

It reads what is already there

Claude Code and Codex both write a full transcript of every session to disk. Actualis parses those files where they already sit. There is no agent to install, no proxy to route through, no wrapper around your CLI, and nothing to configure before the first run.

It measures, it does not interfere

Actualis opens your transcripts read-only and never modifies them. It does not sit between you and your agent, cannot block a command, and cannot change a result. If it stopped running tomorrow, nothing about how you work would change.

It verifies the agent binary

Before trusting a transcript, Actualis checks the code signature of the agent that produced it against the expected publisher — Anthropic for Claude Code, OpenAI for Codex. A tampered or unsigned binary is reported as such rather than quietly accepted.

Every number can be traced

Any figure can be expanded to the records behind it. Ask --why of a finding and it shows the evidence; ask --explain of a metric and it shows the arithmetic, the rate applied, and what was excluded.

On your menu bar

A quiet instrument, until it isn't

The tray app watches in the background and stays out of the way. When a credential you have not seen before turns up in agent context, the menu bar icon takes an amber ring and you get one notification — once per credential, and never a backlog dumped at launch.

  • Native menu bar app for macOS, Linux and Windows
  • Reads the same local data as the CLI — no separate service
  • Report a bug or request a feature straight from the menu
Idlenothing exposed
Exposedcritical credential

Each state has its own shape, not just its own colour, so it still reads if you cannot tell the two apart.

MCP

Let the agent audit itself

Actualis runs as an MCP server, so your coding agent can query its own history — what it spent, what it ran, what leaked — in the same session, without you leaving the terminal.

  • Same redaction and same code path as the CLI
  • Read-only: it exposes data, it cannot change anything
  • Speaks over stdio to a local process — nothing hosted

See what that looks like →

in your agent
> did anything leak this week?

Checking actualis…

  2 credentials in command history:
  Stripe key   critical  12 days old
  GitHub PAT   high       3 days old

  Rotate the Stripe key first.
$ actualis --mcp

Private by construction

Your transcripts never leave your machine

This is not a policy commitment. It is a property of how the tool is built, and you can verify it yourself in an afternoon.

No network code at all

The CLI is written against the Python standard library and imports no HTTP client, no socket, no telemetry SDK. There is no account, no API key and no opt-out to find, because there is nothing to opt out of.

Secrets are handled as secrets

Detected credentials are fingerprinted, never stored in full and never printed. Shared output is redacted by default, and the share command shows you exactly what it will disclose before it writes anything.

Source you can actually read

Licensed AGPL-3.0. The whole CLI is a single auditable file with no third-party dependencies, so “read the source” is a real option rather than a formality.

Nothing is uploaded on your behalf

Bug reports carry the version and platform and nothing else. Your findings, transcripts and project names are yours to share deliberately or not at all.

Honest about limits

What Actualis cannot tell you

A measurement tool that overstates its reach is worse than none. These are the boundaries, stated plainly.

It only sees what the agent already logged
If a session was never written to disk, or the transcript was deleted or rotated away, Actualis has nothing to read. It reconstructs history from records that already exist; it does not create new ones.
Secret detection is pattern-based, so it will miss things
It recognises the shapes of well-known credentials — provider prefixes, key formats, structured tokens. A bespoke internal token with no distinguishing shape can pass unnoticed. Treat a clean report as “nothing matched”, not as “nothing is there”.
Cost depends on published rates, and models change
Spend is computed from the token counts in the transcript against published per-model rates. A model with no published rate is priced at the top of the known range for its provider, so that portion is an upper bound rather than a measurement. It is included in the total but reported as its own number, so you can subtract it and see the floor instead of having to trust the estimate.
A transcript record is not a message
The same assistant record is written repeatedly while a response streams, so one billable message appears many times. Each is counted once, keyed on its message id, and the report prints how many repeats it collapsed. Versions before 0.1.1 billed every record and overstated a real corpus by 2.13× — if you have a figure from 0.1.0, re-run it. A record carrying no id cannot be keyed and is always counted, so a repeat count of zero on a large scan is the signal that something changed.
It supports Claude Code and Codex today
Those are the agents whose transcript formats are implemented. Other tools are not half-supported without saying so — they are simply not read.
It will not rotate, revoke or block anything
Actualis tells you a credential was exposed. Rotating it is your job, and deliberately so — a read-only tool cannot break your workflow, and that guarantee is worth more than the convenience of acting for you.

Contact

Get in touch

Questions about Actualis, licensing, or using it across a team. For anything that belongs in the open, the issue tracker is usually faster.

Support

Actualis is free, and stays free

No paid tier, no per-seat pricing, no telemetry. Support is voluntary, and it funds the next release.

Support development Read the source