failproofai vs OrcaReplay
Observability plus policy enforcement for agent harnesses: records every run across 12 harnesses (Claude Code, Codex, Cursor, Hermes…) and blocks dangerous tool calls with 39 built-in policies. — versus — Time travel for coding agents: a local proxy records any run (Claude Code, Codex, SDKs, even TLS-only harnesses), replays it byte-for-byte offline, and forks from any step onto a different model.
Both capture every run across harnesses; failproofai keeps it for observability and policy enforcement, OrcaReplay for deterministic replay and model forking.
| failproofai | OrcaReplay | |
|---|---|---|
| Stars | 2.6k | 214 |
| Forks | 453 | 66 |
| Language | MDX | TypeScript |
| License | NOASSERTION | Apache-2.0 |
| Last activity | yesterday | yesterday |
| Topics | security, coding | evals, coding |
| Curated connections | 6 | 5 |
failproofai — the curator's take
The one to install the day an agent first runs `rm -rf` or force-pushes: hooks into ten coding CLIs plus the Hermes and OpenClaw gateways, records sessions to a local dashboard on :8020, and enforces policies *before* the tool call runs — sanitize API keys, block .env reads, sudo, terraform/kubectl, destructive SQL, direct pushes to main. Custom policies are a JS file in .failproofai/ that returns allow/deny/instruct; packs are versioned GitHub repos. NOT a tracing platform for agents you built from code (the Python SDK gives tracing but enforcement needs a hook in your runtime), and note the source-available licence and optional cloud — local works without an account.
OrcaReplay — the curator's take
This is the debugger, not the dashboard: `orca record claude` captures the full loop below the agent (requests, streamed responses, tool calls, shell exit codes, file writes), `orca replay last` reproduces it with zero tokens, and `--from N --model X` makes the model the only variable so A/B comparisons actually mean something. Use it to answer 'why did it delete my migration' and to benchmark models on a real run. Skip it for cost/latency observability (failproofai, numbat, agentsight do that) or for agents you can't put behind a proxy or TLS intercept. Small and young (~200 stars); the trace spec is CC-BY, the default endpoint is the maintainers' OrcaRouter — swap it if that matters.