Know what exists
Discover candidate repositories in a folder you choose. Review the list and enroll projects explicitly.
Project ObservatoryLOCAL OBSERVATION / PART OF THE SSHELEG HARNESS
Know what your
agents leave behind.
The code changed. A key reached a log. Another project stopped moving. Give your agent a place to see it, with findings you can act on.
Open source · Local state · Explicit project access
01 / THE BLIND SPOT
A secret can leave its file
without leaving your machine.
An agent reads a configuration file. A tool echoes its output. The result stays in a session log, a memory database or a generated report.
Deleting the original output does not revoke the credential. Observatory can compare known secret values against the artifacts you explicitly select, then record a finding without repeating the value.
A local exposure is not evidence of remote exfiltration or a vulnerability in the application that stored it.
01Configuration
API_TOKEN=[REDACTED]02Agent or tool outputThe value is copied into an artifact
03Persistent copyText log · JSON transcript · SQLite
04Actionable findingLocation, credential label, next action
02 / AN EXAMPLE YOU CAN READ
From a buried copy
to a visible next step.
SYNTHETIC EXAMPLE Fictional project and credential. No live data.
sample-project / local artifactsUNREVIEWED
app.py.envsession.jsonlmemory.sqlitereport.md
tool_result → configuration output
API_TOKEN=[REDACTED]
… other session events …The project still runs. The copied credential is easy to miss among ordinary work artifacts.
sample-project / exposure findingVALUE MATCH
- Credential
- DEMO_API_TOKEN value withheld
- Surface
- Selected session transcript
- Evidence
- A known value matched in the selected artifact
- Next action
- Revoke or rotate at the provider; remove retained copies; scan again
Detection records a finding. It does not rotate the key or erase your history automatically.
The demo illustrates the workflow. It is not a count of incidents found in production.
03 / MORE THAN SECRET SCANNING
Keep the projects
in the picture.
See what moved
Inspect working-tree state, Git activity, dependency counts and disk metrics across enrolled projects.
Track credential exposure
Keep credential metadata separate from values. Scan selected text and SQLite artifacts for known values with redacted findings.
Give the next agent context
Use the CLI and a local dashboard to inspect current state. Share only an explicitly reviewed, sanitized export.
PORTABLE EDITION
This first public edition concentrates on local observation. Cloud-provider adapters, a shared MCP service and scheduling are migration work, not features included in this release.
Read the scope and migration plan ↗04 / ONBOARD THROUGH YOUR AGENT
Start with a demo.
Add access when it is needed.
REVIEW THE SOURCE, THEN INSTALL LOCALLY
git clone https://github.com/ssheleg/project-observatory-open-source.git cd project-observatory-open-source python3 -m venv .venv .venv/bin/python -m pip install . .venv/bin/project-observatory --home "$HOME/.local/share/observatory-demo" demo
Python 3.11 or newer. The demo uses fictional data; choose a fresh demo directory. Commands target macOS and Linux. Follow the onboarding guide for the full setup.
You do not need API keys to try the local workflow. Hand the prompt to your coding agent. It reads the setup guide, prepares an isolated environment and explains each step.
- Try fictional dataInspect a synthetic project and finding before enrolling anything real.
- Choose project foldersPreview discovery, confirm the scope, then run the first local scan.
- Add credentials locallyWhen needed, enter values through the local prompt or standard input. Never paste them into agent chat.
Give this to your agent
Set up Project Observatory from https://github.com/ssheleg/project-observatory-open-source Read README.md, SECURITY.md and docs/ONBOARDING.md first. Use an isolated Python environment. Run the tests and start with the synthetic demo. Explain the portable edition's scope and data location. Preview project discovery before enrolling folders. Ask me to enter credentials through the local secure input flow, never in this chat. Do not echo values, scan other folders, publish local reports or enable background jobs without explicit authorization. Walk me through the first scan and local dashboard. Show what was checked, what was skipped and the next action for each finding.
The prompt stays selectable if clipboard access is unavailable.
05 / THE LARGER WORKING METHOD
Skills guide the work.
Observatory makes its state visible.
The ssheleg harness connects task intent, specialist skills, verification and handoff. Observatory adds an optional observation layer around the repositories your agents work on.
Your coding agent remains the runtime and permission boundary. Observatory is a local instrument, not a sandbox or a promise to detect every secret.