AI agent session recording for Linux servers

An agent uses whatever access the engineer who set it up gave it. That's usually an SSH key. From there it might open a shell, run a single command from a CI runner, upload a config file over SFTP, or step into a container with docker exec.

shellz makes its recorder the login shell for every account on the server. Whichever way the agent connects, the session starts inside the recorder. If a login somehow skips it, the session is killed and you get an alert.

If your deploy agent logs in as ubuntu alongside three engineers, working out who ran what takes detective work. Create a dedicated account such as agent-deploy with its own key. Then a week of agent activity is one search away, and the source IP tells you which runner it came from.

Accounts you create after installing shellz are recorded from their first login.

This example is illustrative, not from a customer. A coding agent on a CI runner is told to ship a fix to web-03 and run the database migration. It logs in as agent-deploy. Filter by that user and you see four sessions within three minutes:

• ›A one-off command that checks out the new release with git, with git's output saved.
• ›An SFTP upload a few seconds later, so the config change sits next to the code change.
• ›A shell where the agent restarts the app with sudo. You see the password prompt in the replay, but not the password. The agent reads the logs and decides the restart worked.
• ›A container session where the agent runs the migration. It printed a warning about a slow index build.

The slow index build turns into a customer ticket. You replay the container session at 4x speed, copy the warning from the transcript, and export the session for the incident doc. Anyone watching during the deploy saw it live, about a second behind.

If part of a recording were missing or edited, the session would be flagged. If the server stopped sending recordings, you'd get an alert within about a minute.

Access vendors spent 2026 adding agent features. Teleport launched Beams in March, which runs each agent in its own isolated VM. Delinea bought StrongDM in March and pitched it as control over what AI agents do (see StrongDM alternatives). HashiCorp Boundary has a preview tool that lets an agent open SSH or RDP sessions without ever seeing the password, though HashiCorp advises against preview features in production. Pomerium and Hoop.dev sit in front of MCP tool servers and databases and apply rules to each request.

These tools control what an agent may do, which shellz doesn't. But each one only sees traffic routed through it. For example, a 2024 reply on Teleport's GitHub says a one-off remote command through Teleport is logged without a recording. Check whether that's still true for your version (shellz vs Teleport).

Use the gateway to decide what an agent can reach. Use shellz to record what actually happened on the server, including anything that went around the gateway. The PAM vs session recording guide covers when each one is worth it.

shellz records login sessions. An agent running as a background service on the server never logs in, so it isn't recorded. Neither is work done purely through APIs, such as an agent querying a database or calling a cloud API.

If you want a background agent's actions recorded, have it run them through a login, for example ssh agent-ops@localhost. For a log of everything that runs, including services, see shellz vs auditd. shellz also doesn't cover Kubernetes kubectl exec, database sessions, RDP or Windows.

When a password is typed at a hidden prompt, like sudo or passwd, shellz doesn't record it.

Anything the agent prints is recorded, though. That includes a token passed on the command line, an .env file it displays, or a debug line that prints an API key. Keep secrets off the command line, and have agents read them from files they never print.

Every recording is encrypted on the server with its own key, and every viewing is logged. With Perfect Secrecy, on every plan, only your team's passkeys can decrypt recordings, so shellz staff can't open one that caught a leaked key. See the security model.