I Built Agent Black Box to Investigate What AI Agents Actually Do

I Built Agent Black Box to Investigate What AI Agents Actually Do

AI agents are becoming increasingly capable. They can call APIs, interact with MCP tools, access resources, and execute multi-step workflows.

But there’s a security question I’ve been exploring:

When an AI agent performs an unexpected action, how do we reconstruct what actually happened?

Traditional application logs can show individual events, but understanding the relationships between agent decisions, tool calls, permissions, and downstream actions is much harder.

That’s why I’ve been building Agent Black Box (ABB).

What is Agent Black Box?

ABB is an observation-only AI agent security forensics platform.

It helps investigators explore:

• Causal security graphs: Visualize relationships between agent actions, tools, identities, and resources.
• MCP tool tracing: Investigate which tools an agent invoked.
• Authority analysis: Examine permission and authority mismatches.
• Incident investigations: Connect detections, timelines, and supporting evidence.
• Multi-agent workflows: Explore behavior across collaborating agents.

The First Hosted Beta Is Live

After local development and testing, ABB Closed Beta V1 is now running on a VPS with Cloudflare Access authentication.

The current beta uses synthetic security scenarios to demonstrate investigation workflows.

It’s important to be clear about the current limitations: ABB is observation-only, single-tenant, and not yet a production-ready multi-tenant security platform. It does not block suspicious actions in real time.

Looking for Developer Feedback

I’m particularly interested in hearing from people building AI agents, MCP integrations, and security tooling.

What evidence would you need to investigate a suspicious AI agent action?

Website: https://abbxai.com

Status: Closed Beta V1, invite-only access.