solongate-audit

AI agent audit log tool. Scans real session logs from Claude Code, Gemini CLI, and OpenClaw, then checks them against the OWASP Agentic Top 10 (2026).

npx solongate-audit

SolonGate Security Audit — OWASP Agentic Top 10

  AI Tools: Claude Code, Gemini CLI, OpenClaw
  Sessions: 33 total, 5104 tool calls
  Period: 30.12.2025 — 17.04.2026

❌ ASI01 Goal Hijacking     NOT PROTECTED
❌ ASI02 Tool Misuse        NOT PROTECTED
⚠️ ASI03 Identity Abuse     PARTIAL
...

  Security Score: 2/10
  Fix 8 critical issues → solongate.com

How it works

1. Reads AI tool session logs from your machine (not the network)
2. Extracts every tool call — name, arguments, result, timestamp
3. Analyzes patterns against OWASP Agentic Top 10 (ASI01–ASI10)
4. Reports PROTECTED / PARTIAL / NOT PROTECTED per category

What it checks

| Code | Category | What's analyzed in logs | |------|----------|------------------------| | ASI01 | Goal Hijacking | Prompt injection patterns in tool args & results | | ASI02 | Tool Misuse | Sensitive file access, destructive commands, data exfiltration | | ASI03 | Identity Abuse | Model identity, privilege escalation, multi-agent overlap | | ASI04 | Supply Chain | Unpinned package installs, unknown tools | | ASI05 | Code Execution | Shell injection, eval, sandbox detection | | ASI06 | Memory Poisoning | MINJA patterns in tool results, unscanned outputs | | ASI07 | Inter-Agent Comms | Multi-agent delegation, receipt chains, fan-out | | ASI08 | Cascading Failures | Error rates, burst patterns, retry storms | | ASI09 | Human-Agent Trust | Deploy/publish without approval, raw intent routing | | ASI10 | Rogue Agents | Volume spikes, scope escalation, behavioral anomalies |

Default log locations

These are scanned automatically — no configuration needed:

| AI Tool | Log location | |---------|-------------| | Claude Code | ~/.claude/projects/<project>/<session>.jsonl | | Gemini CLI | ~/.gemini/tmp/<project>/chats/session-*.json | | OpenClaw | ~/.openclaw/agents/main/sessions/<session>.jsonl |

Custom log directories

Add extra directories if your logs are in a non-standard location:

# Add a custom directory
npx solongate-audit --add-dir /path/to/logs

# Add multiple
npx solongate-audit --add-dir /home/other-user/.claude/projects
npx solongate-audit --add-dir /var/log/ai-agents

# Remove a directory
npx solongate-audit --remove-dir /path/to/logs

# List all directories (default + custom)
npx solongate-audit --list-dirs

# Auto-search system for AI tool logs
npx solongate-audit --search

Custom directories are saved in ~/.solongate-audit/config.json and persist across runs.

CLI

npx solongate-audit                     # Compact report
npx solongate-audit --detailed          # Detailed analysis per category
npx solongate-audit --logs              # Show last 50 tool calls (detailed)
npx solongate-audit --logs 100          # Show last N tool calls
npx solongate-audit --watch             # Live monitoring (updates every 2s)
npx solongate-audit --json              # JSON output for CI
npx solongate-audit --help              # Show all options

Export

Generate report files in multiple formats:

npx solongate-audit --export json       # Full report as JSON
npx solongate-audit --export csv        # Tool calls as CSV (Excel-compatible)
npx solongate-audit --export html       # Visual HTML report (dark theme, filterable)
npx solongate-audit --export pdf        # PDF-ready HTML (open in browser → Print → Save as PDF)
npx solongate-audit --export all        # All formats at once

What each format includes

| Format | Content | |--------|---------| | JSON | Sessions, tool calls, audit results, score, metadata | | CSV | One row per tool call: timestamp, source, session, model, tool call ID, tool name, arguments, result, error status | | HTML | Branded visual report with score card, audit table, filterable/searchable tool call log, expandable arguments & results | | PDF | Same HTML with print CSS (@page A4 landscape) — click "Export PDF" button or Ctrl+P |

CI integration

Exit code 0 if score >= 7/10, exit code 1 otherwise.

# GitHub Actions
- run: npx solongate-audit

Auto-publish

When a commit is pushed to main with a new version in package.json, GitHub Actions automatically publishes to npm. No manual npm publish needed.

To set up: add your npm token as NPM_TOKEN in GitHub repo → Settings → Secrets → Actions.

Scoring

• PROTECTED = 1 point
• PARTIAL = 0.5 points
• NOT PROTECTED = 0 points

Score = sum / 10 (integer).

Install

# Run directly (no install needed)
npx solongate-audit

# Or install globally
npm install -g solongate-audit
solongate-audit

# Or add to a project
npm install --save-dev solongate-audit

Requires Node.js >= 18.

Contributing

# Clone the repo
git clone https://github.com/solongate/solongate-audit.git
cd solongate-audit

# Install dependencies
npm install

# Run in dev mode
npm run dev

# Build
npm run build

# Test locally
node dist/index.js
node dist/index.js --export html

Project structure

src/
  index.ts        CLI entry point, flag parsing
  collector.ts    Reads logs from Claude, Gemini, OpenClaw
  analyzer.ts     OWASP Agentic Top 10 checks (ASI01–ASI10)
  reporter.ts     Terminal output formatting
  export.ts       JSON, CSV, HTML, PDF export
  config.ts       Custom directory config (~/.solongate-audit/config.json)
  types.ts        TypeScript types
  spinner.ts      Loading spinner

How to contribute

1. Fork the repo
2. Create a branch (git checkout -b fix/something)
3. Make your changes
4. Build and test (npm run build && node dist/index.js)
5. Commit and push
6. Open a Pull Request

Issues and feature requests: github.com/solongate/solongate-audit/issues

Fix issues

Visit solongate.com for the full security platform.

License

MIT