Tatu intercepts every Claude Code action before it lands. Leaked AWS keys get blocked. Destructive commands get denied. PII gets flagged. Every event becomes audit-ready evidence — running on your infrastructure, not ours.
Claude Code hooks generate the telemetry. Tatu ingests, correlates, and blocks in real time. Your GRC team gets audit evidence. Your devs get guardrails. All on your own infrastructure.
An AWS key hits a config file — you see it in milliseconds, not in a post-mortem. Filter by severity, hook, developer, or repo.
Which hooks fire most? Which ones never trigger? Tune your security policies with data, not guesswork.
Every blocked action maps to SOC2, GDPR, LGPD, CPS234, and ISO 27001 controls automatically. No more spreadsheet scrambles before audits.
See which agent behaviors trigger blocks most often across your org. Identify gaps in hook coverage before they become incidents.
Structured JSON logs for every agent action. Your SIEM already speaks this language — forward via CSV, JSON, or direct integration.
No vendor lock-in. No data leaving your network. Read every line of source code. Apache 2.0 — fork it, extend it, audit it yourself.
Engineers see which hooks fire and why. CISOs see compliance posture across every repo. GRC analysts export audit evidence without asking anyone. Same data, different views — on your infrastructure.
git clone, docker compose up. Under 5 minutes from zero to a running dashboard. Your data never touches an external server.
Add one URL to .claude/settings.json. Every Bash command, file write, and tool call streams to your Tatu instance — PreToolUse, PostToolUse, all of them.
Threats get blocked before they land. Compliance evidence accumulates with every session. When auditors ask, you export — not scramble.
Every blocked secret, denied command, and flagged PII maps to compliance controls automatically. When your auditor asks 'how do you govern AI agent access?', you hand them a live dashboard — not a spreadsheet from last quarter.
CC6.1 access controls, CC7.2 system monitoring, CC7.3 change detection, CC8.1 change management — covered by hook telemetry
Art.25 data protection by design, Art.30 processing records, Art.32 security of processing — PII detection as evidence
Art.37 processing records, Art.46 technical security measures — continuous DPO evidence from every agent session
Information asset controls, mandatory logging, change management obligations — all generated from hook activity
A.9.4 access control, A.12.4 event logging, A.12.6 vulnerability management, A.14.2 secure development — mapped automatically
Free. Open source. Self-hosted. No signup, no credit card, no vendor call. Clone, deploy, and know exactly what every agent does — before your auditor has to ask.