Prompt to production provenance.
The workspace sensor is the developer-machine surface of the data plane.
Linux
Run this in a terminal. It asks for sudo once.
curl -fsSL https://get.crashoverride.run/endpoint/linux | bash More options
As root, or in automation with no terminal:
curl -fsSL https://packages.crashoverride.run/install.sh | sudo sh To uninstall:
curl -fsSL https://get.crashoverride.run/endpoint/linux | bash -s -- --uninstall What it is
We watch the agents. We are not one of them.
The workspace sensor runs on the developer's machine and observes AI-assisted engineering: which AI coding tools are used (Claude Code, Cursor, Copilot, Codex, Devin), what they were asked to do, what they produced, and how that work moves into the build and out to production. Everything it observes lands in the same data plane as the build sensor's records and what's running in production. The workspace sensor extends the data plane to the machine where the code is written.
What it observes
- Sessions
- For transcript-backed tools such as Claude Code and Codex: the prompts and responses themselves, tied to the user, the files, the tools and the network activity around them.
- Actions
- Tool calls, denied tool use, shell execution with exit codes, and file create, modify and delete.
- MCP
- First-class visibility into Model Context Protocol activity: server starts, tool calls and references.
- Network
- External calls the agent initiates: DNS, URLs, methods, status codes and provider routes.
- Attribution
- Agent-to-source and engineer-to-source attribution, with provider, model and session identity.
- Timeline
- A session-level unified timeline joining AI activity to source change, build, deploy and runtime.