# Stacktrace Fleet

How Stacktrace reads agent sessions, what it does today, the rules it checks and what is coming soon. Web page: https://stacktrace.ai/fleet/

## What Fleet is made of

- **Endpoint** (Sidecar): A sidecar process beside each coding agent, on a laptop, CI runner or cloud session. Read-only, never in the agent's path.
- **Gateway** (Open-source LiteLLM · Envoy): Runs inside the gateway you already operate, and stops a dangerous call before the agent runs it.

## How it works

1. Claude Code writes each session to JSONL files in your environment, which can be a laptop, a CI runner or a cloud session.
2. The Stacktrace sidecar opens those files read-only. No hook or proxy sits in the agent's path.
3. The sidecar matches each tool call to its component in the inventory, then runs deterministic rules.
4. Findings go to the local console and into the running Claude Code session.
5. On Team, findings and inventory go to Fleet. Transcripts and tool output stay in the environment.
6. Notifying findings also go to a webhook if you set one up, package names and versions go to OSV for advisory checks, and usage telemetry with no session content goes to PostHog unless you turn it off.
7. Fleet posts new findings to Slack and serves the org policy, which each environment compiles into Claude Code managed settings.
8. At the gateway (open-source LiteLLM or Envoy), your agents call the model through it. Stacktrace checks each tool call in the response, blocks a dangerous one before the agent runs it, and passes the rest on.
9. Each block is recorded in a findings log in your network, for audit.

## Principles

### Sessions stay in your environment.

Fleet gets findings and inventory, never transcripts or tool output.

### Precision before recall.

A rule ships only once its findings get acted on.

### Out of the agent's path, unless you put it there.

The sidecar reads sessions read-only. Only the gateway sits inline, so it can stop a call.

## Features

| Area | Feature | Stage | What it does | Plans |
| --- | --- | --- | --- | --- |
| See | Inventory | Available | The MCP servers, plugins, skills and hooks each agent uses, with when each was first and last seen | Team, Enterprise |
| See | Vulnerabilities | Available | Known advisories against those components, and the version that fixes each | Team, Enterprise |
| See | Blast radius | Available | The agents a finding reached, and in how many sessions | Team, Enterprise |
| Control | Org policy | Available | One allow and block list for MCP servers, plugins and skills, compiled in each environment into Claude Code managed settings | Team, Enterprise |
| Control | Approvals | Coming soon | Hold a risky tool call until its owner approves it | Team, Enterprise |
| Intervene | Alerts | Available | Findings posted to Slack and to the running Claude Code session | Free, Team, Enterprise |
| Intervene | Active steering | Coming soon | Stop a drifting run, or block a tool call before it executes | Enterprise |
| Agents | Claude Code | Available | Local sessions and cloud sessions | Free, Team, Enterprise |
| Agents | Devin and Codex | Coming soon | The same session reading and rules, for Devin and Codex | Free, Team, Enterprise |
| Platform | Fleet control plane | Available | One console for every agent your team runs, local or cloud, with its findings, inventory and policy | Team, Enterprise |
| Platform | MDM deployment | Coming soon | Install Stacktrace and the org policy on every laptop from your device manager | Enterprise |
| Platform | SSO and roles | Coming soon | Sign in through your identity provider, with roles per team | Enterprise |
| Platform | On-prem | Coming soon | Run Stacktrace in your own infrastructure, with our help | Enterprise |

## Stacktrace rules

Stacktrace checks agent sessions against these rules on every plan. Each finding cites its rule, the evidence, and a proposed fix.

### Reliability

- `stacktrace-tool-retry-storm` (Available): The same tool call, with identical arguments, failed three or more times in a row.
- `stacktrace-blocked-policy` (Available): The auto-mode safety check refused an action and will refuse that kind for the rest of the session.
- `stacktrace-blocked-throttled` (Available): The model provider throttled requests with a 429 or 529, and the agent may not return to the lost work.
- `stacktrace-blocked-upstream` (Available): A service refused a request with a 401 or 403, and the agent moved on without the result.
- `stacktrace-blocked-quota` (Available): The account hit its spend or usage limit, and model calls stop until it resets.
- `stacktrace-deceptive-completion` (Coming soon): The agent claims the task succeeded, and its own test or check results show a failure.

### Operations

- `stacktrace-destructive-action` (Available): An rm -rf targeted a path outside the workspace.
- `stacktrace-infra-unsafe-action` (Coming soon): A command changed infrastructure, a cluster or a database without the user asking for it. Covers: AWS, Kubernetes (kubectl, Helm), Terraform, Google Cloud, Azure, databases. Skips local clusters such as minikube, kind and k3d.
- `stacktrace-unrequested-publication` (Coming soon): A git push, pull request, release or package publish ran without the user asking for it.
- `stacktrace-kube-prod-change` (Coming soon): The agent changed a cluster you marked as prod.
- `stacktrace-kube-prod-shell` (Coming soon): The agent ran kubectl exec, attach, debug or port-forward against a prod cluster.
- `stacktrace-kube-secret-read` (Coming soon): Secret values read from a cluster entered the transcript.
- `stacktrace-kube-rbac-escalation` (Coming soon): The agent granted or assumed elevated cluster privileges.
- `stacktrace-aws-iam-widening` (Coming soon): The agent granted a wildcard or administrator IAM policy.
- `stacktrace-aws-credential-switch` (Coming soon): After an AccessDenied, the agent retried under a different AWS identity.

### Cost

- Coming soon, no rule id yet: Cloud resources the agent started and left running after the task ended.
- Coming soon, no rule id yet: Paid resources the agent created that the task didn't need.

### Security

- `stacktrace-credential-egress` (Available): A credential-shaped value appeared in the arguments of an outbound tool call.
- `stacktrace-credential-persisted` (Available): The agent wrote a secret-shaped value to a file.
- `stacktrace-vulnerable-dep-invoked` (Available): A tool call reached a component with a known advisory.
- `stacktrace-mcp-transient-failure` (Available): An MCP server failed authentication, then a later call to it succeeded.

## Questions

### What is Stacktrace?

Stacktrace reads the session files AI coding agents write and checks each session against detection rules. Findings go to a local console, to Slack and into the running Claude Code session. On Team, Fleet shows the findings and inventory of every agent an org runs and serves one policy to all of them.

### Which agents does Stacktrace support?

Claude Code, in local sessions and in cloud sessions. Devin and Codex are in preview.

### Does Stacktrace upload my transcripts?

No. Transcripts and tool output are read in the environment where the agent runs, and Fleet receives findings and inventory with no conversation text.

### What does Stacktrace detect?

Stacktrace checks sessions against 10 rules in the reliability, operations and security families, listed above. Examples are stacktrace-credential-egress for a credential in an outbound tool call and stacktrace-tool-retry-storm for a tool call that failed three or more times in a row. The stacktrace-kube-* and stacktrace-aws-* rules and the cost rules are coming soon.

### How do I install Stacktrace?

Paste this prompt into Claude Code: "Read https://stacktrace.ai/setup/individual.md and follow it to set up Stacktrace in this environment." The agent runs the installer, starts the daemon and adds the Claude Code plugin.

### How much does Stacktrace cost?

The local sidecar is free, with no account. Team is free too, always: unlimited users, up to 100 agents and 200 session-hours a month. Beyond that, Enterprise is custom and billed annually; book a demo at stacktrace.ai/demo.