00:00rec · start
Observability, audit & security for coding agents — on the machine

Put your coding agents on the record.

Your agents ran thousands of sessions last month. What did they cost — and what did they produce? What did they touch? Do they work the way your company works? Gesta measures, governs, and guides every session — on the machines where it happens.

$ curl -fsSL https://artifacts.gesta.run/gesta/install-agent.sh | bash -s
Get started →
00:14efficiency
Scene 1 · The efficiency

You spent $3M on tokens. What shipped?

The board is asking, and the vendor bill can't answer — it stops at the API key. Gesta answers with a ledger no bill can produce: what your agents actually authored — code, docs, tests — priced at API list rates, every cache tier included.

gesta.run/token-efficiency
Token efficiency · last 30d
$438Ktoken cost
↓ 23% vs last month
148K
Code
96K
Docs
31K
Tests
MemberCostCodeDocsTestsWork type
alex$4123,120640520Coding 71%
sam$3882,2401,380310Coding 64%
jordan$2961,610420240Coding 58%
rowan$1884602,9000Research 62%
Humans only — automation (bots) spent $6.2K, counted in org totals, never listed or ranked.
How the counting works

Measured at the pen, not the paper.

The paper is what a session leaves behind — files, diffs, commits — and paper lies. A formatter rewrites a thousand lines for a one-character fix. A generator emits code nobody wrote. The session that saved your week left no commit at all.

So Gesta doesn't count the paper. It meters the ink: every word the agent itself sets down — code, tests, docs, even a page written straight into your wiki — counted at the moment of writing, before formatters, generators, or git can touch it.

Anyone can see the spend. Only Gesta sees the output — on the machine, at the moment it's written.

Only the counts ever leave the machine. The ink itself never does.

A ledger your model vendor — and your AI gateway — will never show you.

01:24security
Scene 2 · Security

Stop it before it runs.

Your rules push from one console to every agent on every machine, and the dangerous call is held before it executes. Held before it ran, blocked before it left — including the quiet one: a prompt about to carry a plaintext key off the machine.

38
Active rules
2,417
Decisions · 24h
11
Blocked
6
In review
214
Rule hits
gesta.run/policies
ActionAgentUserSessionDecision
Prompt attaches AWS_SECRET_ACCESS_KEYrule: credential pattern · outbound promptCodexsama190block
git push --force origin mainrule: force-push to protected branchClaude Codealex7f3chold
Edit .env.productionrule: write to secrets fileCodexsama190review
rm -rf build/scoped to workspaceClaude Codealex7f3callow
Row one: the key never left the machine — the prompt was held before it went out.

Rules are patterns you push from the control plane — every agent, every session, every machine. We run these rules on our own fleet, every day. Data shown is illustrative.

You can't stop everything an agent does. You can make sure none of it is invisible.

01:52guide
Scene 3 · The library

The fix worked. The next deploy would have erased it.

An agent's Cloudflare-dashboard fix was the internet's right answer — and this company's wrong one. The missing fact now lives in the Organization Library, injected before every answer.

The correct path — change enters Git

Edit dns repo
→
Open PR
→
Merge main
→
dnscontrol syncszone matches code

The shortcut — bypasses Git

Cloudflare hand-editlive instantly · Git blind
next unrelated merge→
Full zone sync
→
Silently erasedno alert · looks routine

A change isn't done when it's live — it's done when it's in the source of truth.

session-d41f · replayWith the library
  1. t+0srule injected — “DNS lives in the dns repo. Never hand-edit the dashboard.”
  2. +3sagent — “Hand-edits get silently overwritten. Opening a PR instead.”
  3. +10mPR merged — live matches code · on the record
“The DNS change went through clean this time — did it strictly by the Organization Rules.”
— our own team channel, one week later

Public knowledge says what usually works. Organization context says how it works here.

02:30position
The position

The work happens on a machine. So does Gesta.

Your gateway sees traffic. Your model vendor sees API calls. Your cloud logs see borrowed credentials. The agent's real work — the files it writes, the commands it runs, the instruction it was given — exists in exactly one place: the machine it runs on.

That's where Gesta stands — SaaS or self-hosted, the daemon sits on the machine. It's why Gesta can count what an agent authored, hold a dangerous call before it executes, and catch a key before it leaves. None of it can be done from anywhere else — not because others won't, but because physics won't let them.

stays on the machineprompts · code · diffs — the ink itself
leaves the machinecounts · events · decisions — the record, tamper-evident

On the record — because it's on the machine.

02:53self-host
Inside your walls

Your prompts and code never leave your network.

Prefer managed? Run Gesta as SaaS — the daemon still sits on your machines, and only the record leaves them. Need even the record to stay in-house? The same stack self-hosts on your own instance: control plane, data, record, all inside your boundary. No vendor backend, no egress by default.

03:14install
How it works

Install once. Every coding agent is covered.

01

Install the daemon

One command on the endpoint: curl -fsSL https://artifacts.gesta.run/gesta/install-agent.sh | bash -s -- --control-url https://api.gesta.run --apikey <secret key>. It hooks the coding agents already installed.

02

Set policy, or use ours

Rules apply to every agent, session, and machine in the org. Start from a maintained baseline and adjust.

03

Watch the record

Live activity, any session end to end, every action attributed — all from one place.

$ curl -fsSL https://artifacts.gesta.run/gesta/install-agent.sh | bash -s -- \
  --control-url https://api.gesta.run \
  --apikey <secret key>
→ downloading gesta-agent · darwin/arm64
✓ checksum verified
✓ Claude Code hook installed
✓ Codex hook installed
✓ daemon configured
✓ agent installed — every session on the record
03:34end

■ session complete · 9 entries · every action attributed

Your agents' sessions deserve the same record.

Install in minutes. Watch your first agent session, attributed end to end.

Start the record Book a demo