sandspy

<div align="center">
  <h1>sandspy</h1>
  <p><strong>Zero-Friction Security Telemetry for Autonomous AI Agents</strong></p>
  
  <a href="https://crates.io/crates/sandspy"><img src="https://img.shields.io/crates/v/sandspy.svg?style=for-the-badge&color=2BB4AB" alt="Crates.io"></a>
  <a href="https://github.com/sagarrroy/sandspy/actions"><img src="https://img.shields.io/github/actions/workflow/status/sagarrroy/sandspy/ci.yml?branch=main&style=for-the-badge&color=2BB4AB" alt="CI Status"></a>
  <a href="https://github.com/sagarrroy/sandspy/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg?style=for-the-badge&color=2BB4AB" alt="License"></a>
  <img src="https://img.shields.io/badge/Discord-icedcappus-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord: icedcappus">
</div>

---

### The Problem

Autonomous AI coding agents like Cursor, Windsurf, Claude Code, and Aider accelerate are being used exponentially, by almost everyone. However, these tools require local shell execution and extensive filesystem access to function optimally, and new engineers and vibe coders are often oblivious to the issues that can happen if these agents are left unchecked.

**This introduces an enormous blind spot.** When an agent is navigating your machine at 1,000 WPM, it becomes nearly impossible to verify structurally safe behavior:

- What `.env` config files or SSH keys did it read?
- Did it accidentally copy your Stripe tokens into the systemic clipboard?
- Did a community script or CLI tool ping an unknown external telemetry server?
- Did it fall for a prompt injection attack and dumped your `.env` file on some remote unknown server?

**sandspy visualizes the invisible.** It is a lightweight, background sensor designed specifically to audit AI coding agents in real-time, giving you total peace of mind without slowing down your development.

<br>

<div align="center">
  <img src="assets/dashboard.png" alt="sandspy TUI Dashboard in Action" wid