execution evidence for code review
The runtime reviewfor your PRs
AI is creating more PRs, but reviewers still only see the code changes — not what happened when the code ran.
Garnet records what ran during execution and attaches that record directly to the PR you already review.
Review faster. Trust your PRs. Merge with confidence.
D
dev-sarah pushed 1 commit 12 minutes agoAdd rate limiter to /api/auth
c91fa03
coding-agent pushed 1 commit 3 minutes ago
Update dependency lockfile
Verifiede7b42d1
garnetbotcommented 2 min ago
coding-agent introduced a new outbound connection in the
build-and-test workflow at 4f7a2c1.47 processes · 4 connections · 123 files
PROCESS LINEAGE
Runner.Worker
└─ bash
├─ bash
│ └─ curl
+ │ scan.aquasecurtiy.org
├─ entrypoint.sh
│ └─ trivy
+ │ check.trivy.dev
└─ python3.12
+ boundary.dfinity.network
+ td tqy-oyaaa-aaaaa-af2dq-cai.raw.icp0.io
How it works
One step. Record and review every run.
Supercharge and ground your existing code review workflows with execution context from jobs.
- 01
Add Garnet
One workflow step attaches our eBPF sensor to the runner to watch every run.
+3 −0.github/workflows/ci.yml
steps:- uses: actions/checkout@v4+ - uses: garnet-org/action@v2+ with:+ api_token: ${{ secrets.GARNET_API_TOKEN }} - 02
Run normally
Your tests, builds, installs, publish jobs, and agent workflows run as usual.
Ddev-sarah pushed to feat/rate-limiterSome checks pending
2 in progress, 1 successful
- build-and-test4m 02s
- garnet profile
- publish
≤2% CPU · no proxy · no code change
- 03
Review the Run Profile
Into a record of what happened in that PR, at a system-level. Feedback surfaced in GitHub, Slack alerts and where you work.
garnetbotcommented just nowattentionRun Profile ready on build-and-test #4823 — 1 new egress flagged
5 runtime checks passedView Run Profile →one record · same context on every surface
“There are a lot of tools that process security advisory data, but Garnet is the first I’ve seen that goes a step further, applying behavioral analysis to find issues before they get reported to an advisory database. … This is the kind of thing we’d always wanted to do at npm, Inc., but never got around to.”
Isaac Z. SchlueterCreator of npmThe primitive
A record of what ran.
agent-run #5120per-run behavioral record
agent-harness:1
claude-code:30
bash:58
curl:63
169.254.169.254
python3:47
scoped to claude-code · commit e7b42d1 · actor coding-agent
Lineage
Process lineage
Which step spawned which binary, down to the syscall.
Network
Network egress
Every outbound connection, attributed to the process that made it.
Files
File access
What was read, what was written, and which process touched it.
Checks
Runtime checks
What matched baseline, what changed, and what deserves review.
evidence from real runs
Click any card to view the full profile.
A new runtime sensor, built from ground up
Kernel-level evidence, for modern development
npmpipai
ci · harness · k8s
jibril · recording
linux kernel
- What you runyour code · dependencies · agents
- Where it runsGitHub Actions · agent harness · K8s
- Garnetrecords every process, file touch, and connection
- Kernelground truth
Overhead
Under 2% CPU
No sidecars, no proxies, no build-time dependencies.
Capture
Deep context, in-kernel
Process ancestry, network egress, file access — at the syscall boundary.
Output
One profile per run
A run-bounded record. Not a firehose of events.
Built for ephemeral CI and agentic engineering.
Making execution observable
For modern teams and agentic software.
Supply chain
Dependencies pulled by agents and CI.
Process-level attribution for every postinstall script and transitive dependency.
postinstall · npm · actions · transitive depsCI execution
Every workflow. Every run.
A Run Profile on every pipeline that holds a credential or touches production.
build · test · release · publishAgentic workflows
Harnesses you can’t see inside.
The transcript says intent. The Run Profile says what happened.
agent harnesses · MCP · sandboxesIR evidence
Minutes, not weeks.
Records already tied to the commit, actor, and workflow.
incident response · forensics · auditThe execution layer
Record every run.Merge with confidence.
One primitive, everywhere your code runs. Start with GitHub Actions. Review your next run before you merge.
$ - uses: garnet-org/action@v2