Claude Code, OpenCode, Codex – with honest attribution
Coding agents run on developer machines with your repo, your credentials and a shell. RAXE watches their sessions and labels how certain the attribution is – on every card, in plain sight.
Claude Code
Live session watching. Every prompt, tool call and file touch lands in the console pinned to the exact agent session – explicit attribution, not a guess.
OpenCode
Live plugin integration with the same explicit session attribution as Claude Code. Sessions, prompts and tool activity on one timeline.
Codex
Codex sessions arrive via ingest. Attribution is inferred from session context – and the console labels it INFERRED rather than dressing it up as live coverage.
Agents on AWS: watched from inside your own account
Which agent role read that secret? CloudTrail knows. Now you do.
Your agents don't stop at the model call – they assume IAM roles, read secrets and call AWS services under identities your SOC rarely watches. RAXE reads your live CloudTrail and raises detections as agent activity lands: an agent role reading a secret becomes a data-exfiltration alert in the console, on the same timeline as gateway claims and kernel-observed file access. Bedrock AgentCore telemetry joins that timeline too.
AWS CloudTrail
A live reader over your CloudTrail events. Agent-role API activity – secret reads, privilege changes – is scored against ATLAS + ASI-mapped rules. An agent role reading a secret raises a data-exfiltration alert in the console.
Amazon Bedrock
Bedrock agent and model management activity surfaces through the CloudTrail lane – which agent roles touched which Bedrock resources, and when. Deeper request-body analysis is on the roadmap.
Bedrock AgentCore
Telemetry from Bedrock AgentCore runtimes joins the same timeline, so managed-agent activity sits next to gateway claims and kernel observations.
One base-URL change at the gateway
RAXE Gateway sits in front of your LLM provider and records the claim side of every exchange – what the agent said it would do: prompts, responses, declared tool calls – scoring each one with the detection stack. Change one base URL; your code stays the same.
Anthropic
VALIDATEDMessages API, including tool use. The gateway records what the agent claimed and scores every request and response.
OpenAI
VALIDATEDChat Completions traffic through the same one-line change. Same detection stack, same evidence trail in the console.
Azure OpenAI
VALIDATEDAzure-hosted deployments through the same gateway adapter. Your Azure networking stays as-is; RAXE runs inside your boundary.
Your provider
ON REQUESTThe gateway is adapter-based, and we publish adapters when they are real – not before. Design partners set which adapter ships next.
If it runs in Python, the SDK fits
RAXE Sensor [sdk] is a Python library. pip install raxe, call it wherever
your code hands a prompt or a tool call to a model, and every verdict lands in the same
console. Fast rules answer in single-digit milliseconds; the full multi-signal verdict
in ~150 ms – all local.
Scan at the boundary
Explicit scan calls where you want them.
from raxe import Scanner
scanner = Scanner()
result = scanner.scan(prompt)
if not result.threat_detected:
response = llm(prompt)The framework pattern
Every Python agent framework hands you the text somewhere – a callback, a hook, a tool wrapper. That is the integration point. No purpose-built adapter required.
# wherever your framework exposes the prompt or tool input –
# a LangChain callback, a LiteLLM hook, a CrewAI tool wrapper –
result = scanner.scan(tool_input) # action, threat_detected, confidence, familyYour framework, one pattern
Callbacks, hooks and tool wrappers all hand you the text – scan it there. The same generic-Python pattern covers, among others:
Purpose-built adapters
ON REQUESTIf the generic pattern does not fit your stack, tell us. Design partners set the adapter queue.
Evidence out, in formats your SOC already reads
Detections and audit events export as CEF, syslog and JSON. If your SIEM ingests one of those – most do – RAXE fits it. No connector-marketplace dependency.
CEF
Common Event Format, mapped so the correlation rules your SOC already runs can read RAXE detections.
syslog
Standard syslog forwarding for pipelines that live on it. Point it at your collector and go.
JSON
Structured JSON export with full verdict detail – per-family scores included – for data lakes and custom pipelines.
Don't see your stack? That's the conversation.
Thirty minutes with an engineer. Bring your agents, your gateway, your AWS account – we'll map exactly where RAXE plugs in and what it will show you.