After a round of improvements, I’ve tagged TrailTool 1.0. It’s backwards incompatible, but hopefully more stable.
The motivation for these changes is the AWS announcement around OAuth support for the AWS MCP server. OAuth/MCP seems like where “agent identity” is trending for AWS-credentialed agents to me. AWS added a new CloudTrail field for OAuth MCP-based sessions - SignInSessionArn in userIdentity.sessionContext. My original session grouping strategy for CLI/SDK sessions using time-based windowing (i.e. approximating) wasn’t ideal. As I started to unravel the changes needed, I ran into a problem - time-based windowing was baked into my primary key (thanks DynamoDB).
I used Claude Mythos and Codex to help work through the rewrite. I used the backwards incompatibility as an opportunity to introduce other improvements, orchestrated with a new issue-flow skill.
Rewriting session aggregation
TrailTool 1.0 is based on the Identity-First Session Model. It’s complicated, but the gist is that the determination of identity (tying to a human/agent) is separate from the session grouping. And for session grouping, time-windowing is only used when we lack better methods. It reads SignInSessionArn explicitly, which adds first-class support for OAuth-based AWS credentials.
replay and reset
I’ve started thinking of CloudTrail as a transaction log against TrailTool’s database. If the log is the source of truth, replaying it should arrive at the same state. So 1.0 adds replay and reset to make iterating easier. replay builds your TrailTool index from existing CloudTrail logs. reset wipes your TrailTool DB. 1.0 is not backwards compatible, but you can rebuild an existing TrailTool deployment with reset and replay.
Ergonomics
Consistent CLI commands (#32). Every noun (sessions, people, resources, etc.) now takes the same list and detail verbs. And detail no longer indexes by position in the last list. Instead of session detail --index 3, which broke the moment the list changed underneath it, you get stable git-commit-like hashes: session detail j4fse4.
Readable clients (#18). I added the concept of clients to make better use of the user-agent data in CloudTrail. Instead of aws-cli/2.34.30 md/awscrt#0.31.2 followed by ~100 more characters of gibberish, session detail just shows a client of aws-cli.
A better session detail (#58). I used Claude Design to reorganize the session detail information hierarchy, and I think it looks nice.
Consistent terminal output (#25). Timestamps, color, and formatting now come from one place - also used Claude Design for this one.
Performance for large volumes. Noun-aggregate DynamoDB writes are now concurrent (#44), and I got rid of Scan by adding an implicit limit (#45) and a time-based index (#47).
One favor if you’ve made it this far - have you run TrailTool? Send me a note on socials or alex@engseclabs.com. Appreciate you 🙌