Telemetry
What gets captured when a tripwire fires, where it goes, and how to wire it into your alert stack.
What a trigger captures
Every tripwire firing produces a structured event:
- Tool — the decoy tool that was invoked
- Agent fingerprint — model, client, and session hash
- Prompt context — the recent message history that led to the call
- Timestamp — UTC, millisecond precision
Delivery channels
- Email — included on Free
- Slack — Pro and Business; uses native blocks for clickable agent fingerprints
- Webhooks — Pro and Business; signed payloads with retry on 5xx
- PagerDuty — Business; native Events API v2 integration
What we don't capture
Source code. Tool arguments containing identifiable data. Anything outside the trigger context window.