~40%
Lower token cost
when agents reason over normalized data (Gruve)
Fleak collects telemetry from AI coding tools, AI gateways, and your own agents, normalizes it to one schema, masks prompts and secrets, and routes it to your SIEM and lake. Security sees what agents did. Finance sees what they cost.
~40%
Lower token cost
when agents reason over normalized data (Gruve)
1
Schema for every AI tool
sessions, prompts, tool calls, and tokens
0
Raw secrets downstream
masked before any destination sees them
Every AI tool logs something different, and most ship with content capture switched off. When someone asks what an agent did, or what it cost, nobody can say.
Claude Code, Codex, Cursor, and Copilot emit different events, fields, and identifiers. Following one session across them is manual work.
Audit trails record who changed a setting, not which commands an agent ran, which files it read, or which data it sent out.
Prompts and tool calls include API keys, customer data, and source code. Shipping them raw to the SIEM creates a new exposure.
Fleak treats AI telemetry like any other security source: collected, normalized, masked, enriched, and routed by what each team needs.
Ingest OpenTelemetry traces, audit logs, and compliance APIs from Claude, OpenAI, Cursor, GitHub Copilot, Gemini, AI gateways, and your own agent frameworks.
Normalize sessions, prompts, responses, tool calls, and token usage into one schema, so one query works across every tool.
Mask API keys, credentials, and personal data in prompts, responses, and tool parameters before they reach any destination.
Enrich every call with the user and team from your directory, track token spend against budgets, and alert before a team overruns.
Detect shell commands, credential access, sensitive file reads, and data egress in agent sessions as they stream.
Route model calls through your AI gateway with budgets, fallbacks, and blocked requests, and keep an audit record of every call and routing decision.
Spot AI tools and models nobody approved, from egress, identity, and gateway telemetry.
Keep a searchable, masked record of prompts, responses, and tool calls for investigations and compliance reviews.
Pair telemetry with Fleak's governed MCP gateway, so every agent's access to your systems is scoped, time-limited, and audited.
What it did, what it touched, what it cost. Answered with a query, not a guess.
The Brain maps each AI tool's events to one schema. The Muscle masks, enriches, and routes them deterministically: risky actions to the SIEM in real time, full sessions to the lake, usage to the teams who pay for it.
Sources
A coding agent runs a command that reads ~/.aws/credentials.
Who finds out, and when?
Without Fleak
InvisibleThe command sits in a local trace export nobody collects. The audit trail shows nothing.
With Fleak
FlaggedThe session event is normalized, the secret masked, and the command flagged to the SIEM in real time.
Accountability
AttributedEnriched with the developer, the team, and the token cost, so the follow-up is a conversation, not a forensics project.
When someone asks what an agent did or what it cost, the answer is a query, not a guess.
"Agents you can't account for are agents you can't scale. The telemetry exists. It needs a pipeline."
AI observability · Fleak Platform
30-minute working session. We'll show their sessions normalized, masked, and searchable.
Receivers, API connectors, and cloud log discovery.
See Detail →One agent, managed centrally, cutting volume before it moves.
See Detail →211 templates, plus AI-generated mappings for the rest.
See Detail →