Prompt turns
Correlated by session and message, so every model call is traceable back to its context.
Runtime security layer
CyxWatch sees everything the agent does.
Every prompt turn, shell command, and file read/write is tracked locally. Risky operations get flagged, policy decisions get enforced before execution, and secrets are scrubbed from storage automatically — so you keep control while the agent works.
Observability
Local telemetry, no network
Shell commands
What ran, when, and against what — with risk flags for destructive strings and sensitive paths.
File reads & writes
Filesystem touchpoints logged, including writes checked against policy before they land on disk.
Risk flags
Automatic detection of sensitive paths and risky shell patterns before anything executes.
Memory firewall
Secrets never leak into long-term state
CyxWatch guards the boundary between what the agent sees and what gets persisted to memory.
Intercept
Memory writes pass through a firewall layer that scans for API keys, JWTs, passwords, and tokens.
→
Redact
Matches are scrubbed automatically before storage. The audit log is stripped of secrets too.
→
Persist
Only sanitized context reaches .cyxcode/memory/ — recall, dream, and graph stay clean.
Policy engine
Decisions enforced before execution
| Decision | What happens |
|---|---|
| auto-approve | Matching operation runs with no prompt. |
| require-approval | Normal permission prompt is shown. |
| block | Tool call stops before it executes. Hard blocks also guard low-level wrappers — destructive process-wrapper commands are caught pre-spawn, filesystem writes pre-write. |
Surface
Inspect from the CLI or dashboard
$ cyxcode watch recent # recent telemetry
$ cyxcode watch report # observability report
$ cyxcode watch alerts # alert history
$ cyxcode watch policy # saved project policy rules
$ cyxcode watch policy --effective # include defaults
$ cyxcode watch report --json --period 30d
Or open the dashboard at /dashboard/security when running cyxcode web.
Full usage guide ↗
Keep the agent on a leash.
CyxWatch ships with CyxCode. No extra install, no external service.