Add Cygnux-Labs/Tracekit to Security & Governance

[LoopGlitch26]

Summary

• Adds Tracekit to the Security & Governance table, between aporthq/aport-agent-guardrails and LembaGang/headless-oracle-v5 (the table is alphabetical, case ignored).

I maintain Tracekit (MIT). On the LangGraph side it has two entry points: TracekitMiddleware, a LangChain v1 AgentMiddleware for create_agent, and tracekit_tool_node for graphs that run their tools through ToolNode. Before a tool runs, both ask a Tracekit signer, which is a separate process. A denied call comes back to the model as an error ToolMessage and the run carries on. A held call pauses the graph with interrupt(), and on resume the signer lets it through only if a person approved those exact arguments. There is also an optional wrapper for any checkpointer that commits each checkpoint to the signer, so a checkpoint edited between the pause and the resume is recorded as a signed gap.

Section

• Community Projects > Security & Governance

Checklist

• I placed the entry in the most appropriate category
• I verified the project or resource link works
• If this is a GitHub repository, it is not archived
• If this is a Community Project, it has recent activity and is not stale
• I followed the formatting style used in the README
• I updated related badges, descriptions, or section placement if needed

Notes

• You can check it in about a minute without an API key. Clone the repo, run pip install tracekit-ai "langchain>=1.4,<1.5" "langgraph>=1.2,<1.3", then python examples/v2/langchain/agent.py --scripted. A mock model asks for ls, sudo rm -rf / and a command the signer can't parse. The first runs, the second is refused, and the third waits in interrupt() until a second process approves it; then the run is exported and tracekit verify passes. I ran exactly that in a fresh venv with tracekit-ai 1.3.0, langchain 1.4.6 and langgraph 1.2.16.
• A limit the row can't fit: in dev mode the signer runs as your own user, so an agent with a shell could get at its key. The record only holds up against the agent when the signer runs as another user, in a container or on another host.
• Setup guide: https://github.com/Cygnux-Labs/Tracekit/blob/main/docs/integrations/langchain.md. The row has the stars and last-commit badges like its neighbours, and npm run lint:md passes on the changed README.
• Happy to reword the row or move it if another section suits it better.