Tracelane MCP server

<!-- tracelane:classification: PUBLIC -->

Tracelane

flight recorder for AI agents.

Get started free → · Docs · Discussions

What it does

Tracelane sits between your AI agents and your LLM providers. You get:

Note the honest scope: evals/ here carries the 20 conformance evals; some internal suites target private ADRs and infrastructure and are not part of this repo, so the test script says so rather than pretending to pass.

• BYOK proxy — point agents at https://gateway.tracelane.dev, pass your own API key. 0% markup.
• Full-fidelity traces — LLM calls, tool invocations, agent steps and retries captured as OTel spans using the GenAI semantic conventions, at full fidelity for everything routed through the gateway. Full capture is the default; there is no sampling you have to turn off. The one bound we do apply is a per-trace ceiling (10,000 spans / 64 MiB, env-tunable) so a runaway agent cannot exhaust your storage — it clips that trace, never your other traces.
• Tamper-evident audit ledger — recorded gateway audit events are hash-chained per tenant. Batches are signed; public transparency-log anchoring is best-effort when configured, and an unanchored batch is reported as such. tlane verify re-checks the chain offline, from the export alone, with no call back to us.
• Inline heuristic guardrails — cost, schema, and prompt-injection rails run in-request at the gateway (ML ensemble on the roadmap). Detection is observe-first by default: a rail records and flags rather than blocking, because a false-positive block breaks a legitimate run.
• Cross-language ledger conformance — the audit verifier is implemented three times, in Rust, Python and TypeScript, and all three are held to one shared corpus of 8 conformance vectors that includes deliberately-forged and boundary-numeric cases. 10 Rust + 14 Python + 19 TypeScript conformance tests run in CI, plus a round-trip job asserting the three implementations agree. That is the suite behind "a third party can verify offline" — you can run it in this clone.

• Time-travel trace viewer — step through any recorded agent trace span-by-span with tlane replay (read-only). Cross-model re-execution is on the roadmap.

every tier including OSS self-host**. Both run as guardrail rails in-request at the gateway: pinning compares a live tool definition against the hash you approved and flags divergence; the trifecta rail flags the untrusted-input + private-data + exfiltration-path combination. Observe-first, like every other rail.

• MCP tool-definition pinning and lethal-trifecta detection — shipped, and **free on

Not shipped — named here because they appear elsewhere in our docs and we would rather you learn it from us than from the source. These are part of the predictive layer, separate from the rails above, and none of them fires on LLM traffic today — for two different reasons:

(mcpservername, tool_name, protocol) that a /v1/chat/completions request does not carry, so they never reach their scoring path.

• Browser stuck-loop prediction and A2UI catalog conformance gate on payload fields

ships, so it cannot flag anything.

• The distilled SLM judge is not enabled: no trained model

Shortened. The full README is on GitHub.