Skip to content
OpenMoatOpenMoat

See what the agent did

Today at a glance

Section titled “Today at a glance”
Terminal window
moat
Protecting Claude Code (hook + OS sandbox) · today: 14 decisions, 1 denied, 1 asked
Claude Code asked to run "git config core.pager less" (rule git-internals, session 4f2a…)
Allow? [o]nce for this session / [a]lways / [n]o

It shows what needs you first. When nothing does, it says Nothing needs you.

The latest decisions

Section titled “The latest decisions”
Terminal window
moat show                 # recent events
moat show 1               # one event in full
moat show --since today   # a time window: today, yesterday, 3h, 7d, 2026-10-15
id     time (UTC) host         verdict rules          action
2      09:12:04   claude-code  defer   default        npm install left-pad
1      09:12:03   claude-code  deny    secrets-paths  cat ~/.ssh/id_rsa

One session as a timeline

Section titled “One session as a timeline”
Terminal window
moat replay --since today

One tree per agent session: every call, its verdict and the rule that decided it.

A report

Section titled “A report”
Terminal window
moat report --since 7d

Totals, the hosts the agents reached, the rules that fired most, and asks per active hour. If you are asked often, this shows which rule does it, so you know what to allow.

Export and verify

Section titled “Export and verify”
Terminal window
moat audit export --since 7d > week.jsonl   # events as JSON Lines, with their chain hashes
moat audit verify week.jsonl                # check it was not changed, without the database