One YAML file earned 180 stars: a solo-built agent "flight recorder" that grew by slipping into other plugins' directories

Tracekit is an open-source project by Indian indie developer Bravish Ghosh that acts as a "tamper-evident flight recorder" for AI agents. In 41 days it gained under 500 stars. It never hit Hacker News or GitHub Trending, and no media covered it. The two days it grew fastest came after the author submitted a single YAML file to Nous Research's Hermes Agent plugin catalog, and it was merged. For anyone trying to earn stars for an open-source project, it's worth breaking down: no step relies on fame, anyone can copy it, but it takes a lot of grind.

The October 27 merge that started it all

On Oct 24, 2026, GitHub user LoopGlitch26 (Bravish Ghosh) opened a PR against NousResearch/hermes-agent titled "feat(plugin-catalog): add tracekit plugin," adding only one file, plugin-catalog/tracekit.yaml. The PR description reads like a security disclosure: which calls the plugin intercepts, which networks it connects to, whether it starts background processes, which files it reads, and whether it has telemetry, all spelled out item by item.

On Oct 27 08:22 (UTC), Nous Research co-founder teknium1 clicked merge. The hermes-agent repo has over 260k stars, and its plugin catalog now lists 1,063 plugins. Users can install Tracekit with one line: hermes plugins install tracekit.

Tracekit's daily star count (GitHub) went like this:

Reposts after the merge all came from Hermes circles: on Oct 27, @HermesAgentTips tweeted it as "another community plugin that caught my eye" (1,460 views); on Oct 29, someone's daily Hermes merge roundup included it (5,700 views); the same day, Nous employee @witcheer recorded a screen demo that got 2,900 views and 37 likes. These numbers are modest, but the people watching are exactly those who have Hermes installed and had just seen the name in the plugin catalog.

What it actually is

The big headline on the README's first screen is a single line:

Agents can edit logs. They can't hide the edit.

The idea: whenever an agent wants to call a tool (run a shell command, write to a database, send a request), a "signer" sitting outside the agent first judges it: allow, deny, or wait for human approval. After the judgment and the execution, every step is signed with Ed25519 and chained together by hashes. A run exports a .tkb file that anyone can verify offline. The design borrows from HTTPS Certificate Transparency logs: an append-only log, co-signed by independent witnesses.

The demo video tells it as a short story: a hidden instruction in a support ticket gets the agent to delete 128 orders, 43 of them, and then it goes back and edits its own log, along with Tracekit's record, changing the deletion to a "query." Grep the log and you find no DELETE; the database has 85 orders left and looks fine. On the Tracekit side, once the run ends, verification reports FAILED: "seq 7: hash does not match the event" — record 7 was tampered with.

Trying it takes one line, no API key needed:

``sh uvx --from tracekit-ai tracekit demo --server ``

The author says it finishes in 5 seconds on a Mac. There's also a more "this affects you" entry point: tracekit audit reads the sessions you've run in Claude Code locally and tells you which of those calls would have been blocked or held for approval had Tracekit been installed.

The first screen of the README also shows four experimental numbers: "all 8 tamper attacks caught (480 trials)," "828 harmful calls, 828 blocked (881 trials with 1 false positives)," "under 1 ms added per call," and "all 8 insider attacks caught." Each number is tagged with an experiment ID, E1, E17, E9, E8, matching two preprints the author posted on arXiv. For a one-person project, it looks like the output of a research lab.

Why now

In the second half of 2026, agents like Claude Code, Codex, and Hermes were already running commands directly on many people's machines, so "will the agent delete its own records?" stopped being hypothetical. WorkOS published an article testing exactly that: asked to delete its own traces, nearly every harness complied. Anthropic's Claude Code repo also has an issue discussing how hooks can be bypassed (#45427). Claude Code ships with deny / ask / allow permission rules, but both the rules and the logs live on the agent's side. Tracekit's pitch comes down to one thing: put the signer where the agent can't reach it.

Where stars came from, and where they didn't

Laying out everything the author did for promotion over the past month makes it clear what worked and what didn't.

What worked: getting into someone else's official plugin catalog. One merged YAML file brought roughly 180 stars over two days. The prerequisite was laying the integration groundwork first: the README lists support for 25 agents and frameworks (Claude Code, Codex, Cursor, Gemini CLI, Hermes, LangGraph, CrewAI, E2B, and more), and each integration created another chance to apply for listing in that platform's catalog or docs. Hermes was the first to say yes.

Also worked: turning newcomer contributors into stars and forks. From Nov 2 to 5, the author opened a batch of issues tagged good first issue / help wanted, such as "write hooks for OpenHands, Cline, gptme," "19 CLI flags missing from --help," and "a five-row docs table broken by a | in the code." By 11-06, the repo had 78 issues tagged good first issue (GitHub, 11-06), plus a configured Codespaces dev container so you could start editing with one click. Since November, external PRs totaled 33. The second wave of stars (11-04 to 11-06, +108) and forks rose together: forks went from 11-02 to 47 to 11-06 to 64. About 20 outside contributors came in, many apparently students in India judging by their names. How they found the project (good-first-issue aggregators, schools, communities) wasn't determined.

What didn't work:

• Submitting to awesome lists and big framework docs. From Oct 18 to Nov 3, the author opened PRs or issues against vercel/ai, pydantic-ai, google/adk-docs, awesome-for-beginners, Awesome-LLMOps, awesome-claude-code, and more than 20 other repos. By 11-06, none had been merged.
• Asking people to recommend it. Dan Kornaś posted a recommendation on X on Oct 21 (1,300 views) and on LinkedIn; stars went up by only 8 the next day.
• Posting on X themselves. The author, @bravish_, posted with every release, usually getting a few hundred views, at most 1,700.
• Security tool site KitPloit tweeted a feature on Oct 23 (2,500 views); star counts barely moved over the next two days.

Never tried: Hacker News, Reddit, Product Hunt. Not once.

Who it's competing with

The "agent observability / guardrails" lane is crowded, but the "evidence you can't edit" niche is still wide open:

The halo-record row says it best: same idea, launched three-plus months earlier, and it has only 85 stars. Differentiation alone doesn't earn stars; distribution does.

Lots of stars, few users

The PyPI package tracekit-ai got 510 downloads in the last 7 days (pypistats, 11-06). Normally it's twenty to fifty a day, jumping to a hundred or two on release days, most likely driven by releases and CI (inferred). The author shipped 16 versions from late September to November 3, going from v0.3.0 all the way to v1.5.3, and opened 128 PRs themselves. Low usage doesn't block stars. If anything, the nearly 500 stars mostly mean "looks solid, bookmarking for later," not "actively using it."

The project also offers an Enterprise early-access signup and a "two-week free pilot," and has a Manifund crowdfunding page; how much money it raised wasn't determined. For someone chasing stars, none of that matters much.

If it were you

Grade B: worth a try. The playbook is something anyone can copy, doesn't rely on fame or big-company traffic, but its ceiling is a few hundred stars and the engineering load is daunting, so run the cost-benefit yourself first.

Good fit for: people already building agent-related tools (security, auditing, memory, cost control, testing), developers who can code intensively for weeks at a stretch, and those who know a given agent platform's plugin interface well and are willing to read its listing rules carefully before submitting a PR.

Not a fit for: anyone wanting to build a second "tamper-evident log." Tracekit already holds that slot, and halo-record trails it, so you'd just be competing head-on. It's also not for those hoping for thousands of stars from a single post; this playbook is built up slowly.

How to do it:

• Find a gap Tracekit hasn't filled or has done only modestly. It acts only at the two ends, before and after the agent acts; the reasoning in between, statistics across many runs, and reports for non-engineers are still open. You could also switch ecosystems: it's a Python plus TypeScript verifier, and I haven't seen anyone doing the same thing in the Go or Rust worlds, or on low-code agent platforms like n8n, Dify, and Coze (not checked one by one).
• Build your first screen like Tracekit's: a one-line headline, a story-driven demo (the agent causes trouble, and it gets caught), a one-line trial command that needs no key, and a command users can run on their own data.
• Turn experiments into numbers on the first screen, and link preprints where you can.

How to get users:

• Connect to 3–5 agent platforms first, and submit for listing in each platform's official plugin catalog or marketplace as you finish each integration. Write the PR description the way Tracekit's went to Hermes: what it blocks, which networks it connects to, whether it starts background processes, which files it reads, whether it has telemetry, each item spelled out so maintainers feel safe merging. Don't spend your effort on awesome lists; Tracekit submitted more than 20 and none were merged.
• Once the catalog merge is live, reach out the same day to people in the platform's community (plugin curators, official staff) and share a screen recording.
• When stars level off, open a batch of concrete, line-specific good first issues, set up Codespaces, and bring in newcomer contributors to kick off a second wave.

When would this break: the agent plugin catalogs are still early, so the bar for listing is low and new plugins still get eyes. Hermes' catalog already has 1,063 plugins, and the more entries it has, the less attention each new one gets. Get into the first big catalog merge before 2027 Q1 (inferred).

How you'd know you misread it: ① your plugin lands in a big catalog and stars don't move in two days: that would mean Tracekit's 180 stars came from the Hermes-week word-of-mouth lining up by chance, not from the catalog itself; ② Hermes or another platform starts gating catalogs or sorting by installs, so new plugins stop showing up: the window is closing; ③ Claude Code or Codex ships an official signed audit log: big vendors would take over this whole category of tools.

A last note for anyone chasing stars: Tracekit's most useful lesson isn't in the code, it's in that YAML file. Rather than waiting to be discovered, plug your project into a platform that already has lots of users, then ask someone there to click merge.

---

Data and sources: GitHub repo page and API (stars, forks, issues, PRs, as of 2026-11-06); NousResearch/hermes-agent PR #143958 (merged 10-27); X posts from @HermesAgentTips, @witcheer, @iamlukethedev, @KitPloit, @DanKornas (view counts as seen around 11-06); pypistats (tracekit-ai); arXiv 2609.35659, 2610.38458; WorkOS blog "AI agent trace tampering"; anthropics/claude-code issue #45427. Where it says "inferred," it's an inference.