$ trace discover
  ✓ ollama            (inference)     14 artifacts
  ✓ hermes            (agent)         60 artifacts
  ✓ huggingface       (cloud)         68 artifacts
  ✓ text_gen_webui    (inference)      2 artifacts
  ✓ llama_cpp         (inference)      2 artifacts
  ✓ network_ai        (live)          process→domain classification

Features

• 26 Collectors — Ollama, Hermes, LM Studio, GPT4All, text-generation-webui, llama.cpp, KoboldCpp, AutoGPT, CrewAI, Aider, Shell-GPT, Cursor, Claude Code, HuggingFace, LiteLLM, Bifrost, Unsloth, Antigravity, Devin, VSCodium, Eigent + the Shadow AI meta-collector, the Network AI collector (live process→domain AI traffic), the Code Scanner collector (AI framework imports, MCP configs, hardcoded API keys), the Docker AI collector (Gordon + hosted LLM images/containers), and the Browser AI collector (Brave Leo, Perplexity, Copilot, ChatGPT, Gemini web)
• Live Network AI Detection — correlates running processes with outbound connections and classifies destination domains against a catalog of 100+ AI providers (OpenAI, Anthropic, Gemini, Bedrock, etc.)
• Source-Code AI Scanning — detects AI framework imports (LangChain, CrewAI, AutoGen, 80+ others), MCP server registrations, and hardcoded API keys in code
• Docker AI Detection — detects Docker's AI assistant (Gordon) and hosted LLM workloads (ollama, LocalAI, vLLM, OpenWebUI, etc.) in containers and the model registry
• Browser AI Forensics — captures browser-based AI assistant evidence (Brave Leo, Perplexity, Microsoft Copilot, ChatGPT, Claude, Gemini web) from browser history and per-site conversation stores
• Full Analyzer Set — Unified Timeline, IOC Extractor, MITRE ATLAS Mapper, Risk Scorer, AI-specific IOC Detector, Enhanced Risk Scorer, and Conversation Parser
• 3 Report Formats — Interactive HTML (attack-surface map, charts, stats), JSON, STIX 2.1
• 15 Velociraptor Artifacts — Deploy to fleet endpoints via Velociraptor server
• Forensically Sound — Read-only collection, SHA-256 per file, chain of custody manifest, UTC timestamps
• Cross-Platform — Linux, macOS, Windows paths per collector

Quick Start

# Install
pip install ionsec-trace

# Discover AI platforms on the system
trace discover

# Collect all forensic artifacts
trace collect --output /tmp/evidence --deep

# Analyze collected evidence
trace analyze /tmp/evidence --mitre-atlas --mitre-attack --risk-score

# Generate reports (HTML, JSON, STIX 2.1)
trace report /tmp/evidence --format all

Go Binary (no Python required)

TRACE ships as a single self-contained Go binary so anyone can run shadow-AI detection without installing Python. Prebuilt executables for macOS, Linux, and Windows live in go/bin/ (build with make -C go), or build your own:

make -C go all    # builds bin/trace-{darwin,linux,windows}-{amd64,arm64}

The CLI is fully branded and interactive: a two-tone crimson logotype banner, branded header boxes, severity-colored output, and live spinners during long operations. Every scan/run prints the executing machine's system info and a timestamp.

# ONE-SHOT SWEEP: discover → deep collect → HTML + JSON reports
./bin/trace-darwin-arm64 run -o /tmp/evidence

# Detect shadow-AI tools
./bin/trace-darwin-arm64 discover

# Quick risk summary with system info + timestamp (no files written)
./bin/trace-darwin-arm64 scan

# Collect forensic artifacts + chain of custody
./bin/trace-darwin-arm64 collect -o /tmp/evidence --deep

# Generate JSON + HTML reports from existing evidence
./bin/trace-darwin-arm64 report -o /tmp/evidence

The Go binary mirrors the Python CLI's detection logic and forensic data model (chain of custody, SHA-256 hashing, UTC timestamps), producing interchangeable evidence. Its JSON report schema and HTML report brand are aligned with the Python reporters (metadata block, per-platform inventory, severity summary, risk score, KPI stat strip). The source is in go/ — stdlib-only, so it cross-compiles cleanly.

Curated evidence collection

Collection is deliberately curated to analyst-parseable artifacts — only config, history, session, credential, and conversation stores are retained. Unparseable noise (compiled extensions, README/LICENSE, .DS_Store, model blobs, node_modules, automated backups) is skipped, so the evidence set stays readable and low-noise instead of ballooning into hundreds of binary blobs.

Non-readable structured stores are parsed into analyst-facing summaries: SQLite conversation/state databases yield their schema (table list), row estimates, and redacted sample strings; text config/log files get a bounded readable preview. These summaries are embedded in the generated JSON report under parsed_artifacts[].

CLI Commands

Options

• --deep — Collect session-level data (conversations, chat history)
• --platforms ollama,hermes — Collect from specific platforms only
• --mitre-atlas — Map findings to MITRE ATLAS techniques
• --mitre-attack — Map findings to MITRE ATT&CK techniques
• --risk-score — Calculate risk scores (0-100)
• --secret-hunt — Scan conversation turns for leaked secrets (leak direction, per-field provenance, salted fingerprints)
• --export-conversations — Export conversation history to CSV + SHA-256 manifest
• --format html|json|stix|all — Report format

Collection Output

/tmp/evidence/
├── CHAIN_OF_CUSTODY.json    # SHA-256 manifest with timestamps
├── TRACE_Report_<id>.html   # Interactive forensic report (map, charts, stats)
├── TRACE_Report_<id>.json   # Structured JSON report
└── TRACE_Report_<id>.stix.json  # STIX 2.1 bundle for MISP/OpenCTI

Chain of Custody

Every collection produces a CHAIN_OF_CUSTODY.json containing:

{
  "tool": "TRACE",
  "version": "0.5.0",
  "collected_at": "2026-08-13T08:56:55Z",
  "total_files": 144,
  "files": [
    {
      "original_path": "/root/.ollama/config.json",
      "source_os": "linux",
      "platform": "ollama",
      "artifact_type": "config",
      "size_bytes": 42,
      "sha256": "abc123...",
      "collected_at": "2026-08-13T08:56:55Z"
    }
  ]
}

Supported Platforms

Local Inference Engines

Agent Frameworks

Development Tools

Cloud / Cache

Live Network & Code Scanning

Analysis

IOC Extraction

Extracts 10 types of indicators:

• IP addresses, URLs, domains, file paths
• Email addresses, command strings
• MD5, SHA1, SHA256 hashes
• API keys (OpenAI, GitHub, Anthropic, xAI patterns)
• Data exfiltration patterns (base64 encoding, pipe to network)

AI-Specific IOC Detection

The AIIOCDetector catches AI-specific indicators of compromise that generic extraction misses:

• Jailbreak — DAN mode, prompt injection, system prompt leakage
• Tool abuse — unauthorized agent tool calls
• Credential exposure — API keys, tokens, secrets in conversations/CLI
• Exfiltration — base64 payloads, network exfiltration patterns
• Model manipulation — tampering with model weights/config
• Encoding attacks — obfuscated/encoded payloads
• Sensitive paths — access to /etc/shadow, SSH keys, cloud credential files

MITRE ATLAS Mapping

Maps findings to 10 ATLAS techniques:

• AML.T0010 — Prompt Injection
• AML.T0011 — LLM Jailbreak
• AML.T0025 — Modify Model
• AML.T0043 — Craft Adversarial Input
• AML.T0048 — AI Tool Integration
• AML.T0049 — Exploit AI Tool Integration
• AML.T0050 — LLM Data Exfiltration
• AML.T0052 — LLM Prompt Leak
• AML.T0054 — AI-Generated Content
• AML.T0055 — LLM Credential Theft

MITRE ATT&CK Mapping

Cross-references ATLAS techniques to MITRE ATT&CK (e.g. AML.T0055 → T1552 Unsecured Credentials, AML.T0050 → T1048 Exfiltration Over Alternative Protocol) and derives technique mappings from findings and IOCs.

Risk Scoring

The EnhancedRiskScorer scores 0-100 across 8 behavioral categories (each 0-12.5):

It also produces kill chain stage analysis (7 stages), attack narratives, and priority actions with urgency ratings.

Severity: Critical (90-100), High (70-89), Medium (40-69), Low (0-39)

Conversation Parser

Parses collected conversation/session data into structured turns and sessions, extracting findings (jailbreak attempts, tool calls, risk assessments) from chat history.

Tool-call evidence is promoted to first-class fields — tool_command, tool_input, tool_description, and workspace — so analysts can review the exact shell command and structured arguments an AI assistant invoked. Identical user prompts that appear across multiple platforms (e.g. Claude Code and Cursor) are deduplicated, with the kept turn's also_in_tools list preserving every platform that ran the same prompt.

Conversation Secret Hunt

Run trace analyze --secret-hunt to scan conversation turns (prompts, responses, and tool-call evidence) for leaked secrets. Each finding is enriched with:

• Leak direction — whether the secret flowed user→service (typed by the subject) or service→user (returned by the model / a tool result)
• Per-field provenance — which evidence field (content, tool_command, tool_input, tool_description) carried the secret, with start/end offsets
• Salted fingerprint — a stable per-scan hash so the same secret can be correlated across rows, sessions, and platforms

Findings are permanently redacted (first4…last4 + length); cleartext never crosses the result path. Results appear in the HTML report's Secret Hunt tab and in report.json under conversation_secret_hunt.

Conversation Export

Run trace analyze --export-conversations to write a shareable evidence package: a *_timeline.csv of the parsed turns plus a manifest.json recording the SHA-256 of every source artifact, so the originals can be independently re-verified.

Interactive HTML Report

The HTML report is a self-contained, interactive forensic report (no CDN dependencies) featuring:

• Attack-surface map — interactive node/edge map of platforms, IOCs, and correlations
• Charts — findings by severity, IOCs by type, platform inventory
• Stats — summary statistics dashboard
• Full timeline, IOC list, ATLAS/ATT&CK mappings, kill chain, priority actions, and conversation secret hunt

Velociraptor Artifacts

15 artifacts for fleet deployment (all validated with velociraptor artifacts verify):

Forensic Soundness

• ✅ Read-only — All collectors are read-only; no source modification
• ✅ SHA-256 — Every file hashed at collection time
• ✅ Chain of custody — Manifest with tool version, timestamps, per-file hashes
• ✅ UTC timestamps — All timestamps in ISO 8601 UTC
• ✅ Append-only — No deletion capability in tool
• ✅ Minimal footprint — No agents, no registry changes, no persistent processes

License

AGPL-3.0-or-later — see LICENSE for details.

Contributing

See CONTRIBUTING.md for development setup and collector template.