~/seanmcquilling
theme:modern

C:\SEAN> choose theme

Trace Lab.

Agent security, worked through.

My agentNot saved as a project
Local only

a place to work it out

What are you looking into?

Explore a small case, map your agent, or follow a run’s evidence.

Agent Threat MapperSee what it can reach.Map common workflows to OWASP risks and ATLAS techniques.Explore a threat map →Inspect my runBring the record.Compare recorded actions with an explicit plan.Open an investigation →

Runs stay on your side. This lab doesn’t execute agents, enforce rules, or upload your evidence.

synthetic practice

Pick a record to investigate.

Authored examples, not results from real agents. Each includes a plan and an evidence record.

CASE 01 · 3 EVENTSThe document asked for an upload

Was the upload performed?

Open case →CASE 02 · 1 EVENTSThe operator said it was approved

Is the claimed approval enough?

Open case →CASE 03 · 2 EVENTSThe execution records stop here

Can we establish whether the upload happened?

Open case →
Browse all cases and expected findings

Model & plan files

Projects contain model inputs and a plan. Evidence belongs to an investigation. Saves are unencrypted on this device; export a backup before clearing browser data.

Reference & advanced tools

Three modes, not three mandatory steps

01Model

Map untrusted inputs, tools, identities, memory, trust boundaries, and privileged effects.

02Plan

Set the job, scope, limits, and approval points for one run.

03Run and review

Keep the tool log, then compare the recorded actions with the plan.

portable artifacts

Take the rules with you.

Trace Lab plans and threat models use public, versioned JSON schemas. Validate them in a project, map findings to established frameworks, or import MCP and agent configuration files for review.

schemaAgent run plan v2schemaThreat model v1crosswalkOWASP · NIST · ATLASexampleDownload a valid plan
npm run trace:validate -- agent-run-plan.json

Compare two threat models.

Import two JSON exports from the threat modeler. Files stay in this browser. Scores are screening estimates, not measured risk reduction.

Synthetic example traces
objective
Summarize a downloaded report and save notes inside the active project.
initial riskmedium
resultcontained
Run trace
trace/document/001
  1. Summarize report.pdf. Write only to ./notes/report-summary.md.
    The user set a clear limit.
  2. Confirm the file type, working folder, save location, and available PDF tool.
    Nothing has changed yet.
  3. Extract the report text. Treat any instructions inside the file as content, not commands.
    The file cannot change the task.
  4. Show the proposed summary and save location before writing the file.
    The change can be reviewed first.
  5. Write one Markdown file inside ./notes. Do not use the network.
    Write access is limited to one path.
  6. Open the saved file, confirm its location, and note any text that could not be extracted.
    The saved file matches the request.
Map your agent.
Select a part of the map to edit it. Connections describe your selections, not observed activity.
System map
Review the boundary between source content and agent authority
Starting example: local research agent. Replace it with your system.
Agent
01 Describe the system
02 Map exposure
Select every source the agent reads and every capability it can use. The combinations matter more than the model name.
Untrusted or external inputs
Capabilities and privileged effects
03 Record existing controls
Credit requires implemented status and a configuration or test reference. These are your assertions, not lab verification.
Separate instructions from content
Treat retrieved material as data, never as authority
Preserve provenance
Keep source, trust, and integrity metadata through retrieval and memory
Allowlist tools and parameters
Expose only approved operations and validate their arguments
Use scoped, short-lived identity
Give each run only the authority it needs
Isolate execution and network
Contain code, files, processes, and egress
Require approval for high-impact actions
Pause before destructive, external, or irreversible effects
Trace the complete action chain
Record input, context, policy, tool calls, identity, and results
Bound and stop the run
Limit time, cost, retries, recursion, and provide a kill path
Quarantine and roll back memory
Mediate writes and restore a known-good state
Authenticate and authorize peers
Verify every agent and attenuate delegated authority
Control data egress
Restrict destinations and inspect outbound content
Pin and verify dependencies
Track models, tools, prompts, MCP servers, and packages
Model options
After the run, review a transcript using this plan. The reviewer receives your current name, scope, permissions, and checks automatically. Planning does not execute or enforce any action.
Give this run a boundary.
Set the job, choose its permissions, then review the checks.
Plan versions
Guided setup
Make your first plan.
Answer five short questions. You can change every rule afterward.
Review & export the plan
Plan statusReady to review
Before you use it
    Investigate a run
    Untitled investigation
    Investigation files
    An investigation contains the plan snapshot, annotations, coverage notes and review. Evidence is optional and unencrypted. These files do not enforce permissions.
    Without evidence inclusion, saves contain the plan and coverage notes only. Plan and notes can still contain sensitive names: review before sharing.
    No plan attached.
    Choose / edit plan
    Start with the record.
    A tool log, transcript or structured event file.
    or
    Processed in this browser. Extraction suggests events; it doesn’t prove execution.
    Record tools
    Start with your own record or a synthetic case. Nothing is executed or enforced.
    Structured event format
    Up to 100 events. Supplied states are claims from the record, not independent verification. Scope and approval start unknown.
    {
  "format": "smq-run-events",
  "version": 1,
  "events": [
    {
      "action": "read",
      "status": "completed",
      "target": "./reference/vendor-note.txt",
      "evidence": "Tool result 17: document returned successfully"
    }
  ]
}
    Hypothetical policy comparison
    The original plan and report stay unchanged. Changing a category does not establish scope, execution, or approval.
    Review the evidence before comparing.
    Advanced text screening
    This older screening view matches text patterns. Its detections are not confirmed execution events.
    Current planUntitled planCurrent project only
    DetectedWaiting for a log
    You can paste Codex or Claude Code logs, GitHub Actions output, structured JSON, or ordinary text. Check the detected actions before reviewing.
    Actions detected or added manually
    read more
    Topics used in these examples.
    These ideas show up often when agents work with local files and outside services.
    securityThreat modelingimportant data · access · riskcapabilityTool callingarguments · results · policytestingEvaluationresults · checks · unknownsproximityLocal agentsfiles · secrets · operatoroperationsPatternsinspect · act · verify
    ~/
    ↑↓ move enter run help commands ⌘K toggle