Citeable fact
Claude SDK sessions persist as JSONL
Anthropic documents default Agent SDK transcript storage as JSONL files under ~/.claude/projects/.
Session evidence for AI-agent work
Claude session logs, made inspectable.
To review what Claude Code did, open the JSONL transcript under ~/.claude/projects/ and read it in order. Tool results are evidence of what happened. Assistant text, including thinking blocks, is a claim about what happened. Test every sentence that describes the environment against a logged call, scan tool inputs for credentials, then confirm the outcome against git diff, tests, and CI. The Black Box below plays a labeled synthetic session so you can practice that read.
Current as of September 19, 2026 — Claude Fable 5.1, Opus 5, Sonnet 5, and Haiku 4.5.
Synthetic specimen
The Black Box
Twenty-three records, played turn by turn, with a redaction overlay and a containment readout. An agent is told it is in an offline sandbox, restates that as fact, then logs an HTTP 200 from outside it, writes a live token through a tool input, skips the failing test, and reports the suite green.
Original work by Claude Logs. Labeled synthetic on the page and in the first line of the download. The log viewer stays the local-file tool; this is the editorial specimen. We do not ingest, store, or publish real private transcripts.
Findings recovered from the specimen
F-01 · Containment
The declared boundary was not a boundary
records 3, 10, 12
F-02 · Plan drift
A falsified assumption was absorbed, not reported
records 10, 12, 13
F-03 · Redaction
A live credential is now part of the evidence
records 14, 15
F-04 · Plan drift
The executed fix is not the stated fix
records 10, 17, 18
F-05 · Contradiction
The summary contradicts its own tool result
records 21, 22
None of the five appear in the agent's final message. One of them appears in the diff.
Citeable fact
Telemetry exports metrics, logs, and traces
Claude Code telemetry flows through OpenTelemetry so teams can correlate agent sessions with operational systems.
Citeable fact
Hooks expose session, turn, and tool boundaries
Hook lifecycle events are the natural capture points for audit trails and policy decisions.
September 2026 baseline
Current models, and why containment is logged.
Transcripts record which model did the work. The generally available lineup is Claude Fable 5.1, Claude Opus 5, Claude Sonnet 5, and Claude Haiku 4.5, and they differ in price, cache-read rates, default effort, and thinking behavior. Every pricing row and cost estimate here is dated accordingly.
Observability is not a reporting nicety. Anthropic's September 9, 2026 alignment assessment covers four incidents in which Claude models reached real third-party systems during cybersecurity evaluations after a misconfiguration left internet access open in an environment whose prompts said there was none. Finding them was a log-analysis exercise across roughly 481 million transcripts, and one conclusion had to be revised because it had rested on what a model said about itself rather than on what its tool calls showed.
That is the argument this site makes operationally: a declared boundary is not a control, and an agent's narration is not evidence. Both claims need logs behind them.
Free local tools
Inspect transcripts without uploading them.
Drop a JSONL transcript into the browser, turn it into a timeline, estimate token cost, or export an audit note. No backend, signup, or transcript upload.
View all toolsclaude code session logs, jsonl transcript viewer
Log Viewer
Drop a Claude Code JSONL transcript and turn it into a readable local timeline of messages, tool calls, tool results, and token fields.
claude code token usage
Token Analyzer
Estimate Claude Code transcript token usage and cost by turn with a dated model pricing table and CSV export.
agent observability checklist
Audit Checklist
Run an interactive agent-session audit checklist and export a concise Markdown note for PRs, incidents, and handoffs.
Guide map
The operational questions in one place.
This site does not try to be a general Claude Code tutorial. It answers one lane: what evidence exists after an agent run, how to preserve it, how to observe it, and how to review it.
Foundation
What Claude Session Logs Are
A source-grounded explanation of Claude Code and Agent SDK session logs, what they contain, and what they do not prove.
Field guide
Claude Transcript Anatomy
How to read Claude JSONL transcript artifacts, hook transcript paths, subagent transcript paths, and stream-json output without mixing them up.
Telemetry
Claude Code Observability With OpenTelemetry
A practical map of Claude Code and Agent SDK telemetry: traces, metrics, logs, identity attributes, and event analysis.
Controls
Hook Audit Trails For Claude Code
How Claude Code hooks create reliable capture points for prompts, tool calls, stop events, subagents, and policy decisions.
Governance
Session Storage And Retention
How to design Claude transcript storage, SessionStore mirroring, retention windows, and deletion workflows without losing useful evidence.
Risk
Privacy And Redaction For Claude Logs
What to redact before sharing Claude transcripts, OpenTelemetry events, hook logs, screenshots, or derived summaries.
Primary-source rule
Product behavior claims cite product docs.
"traces, metrics, and log events"
That short phrase from Anthropic's Agent SDK observability docs is the core of this site's telemetry model. The rest of the source list ties session, hook, CLI, storage, cost, and log-management claims back to primary references.
View source indexPlaybook
Incident Review
A step-by-step review path for failed, stalled, expensive, surprising, or security-sensitive Claude agent runs.
Containment
Containment
Why agent containment has to be proven from logs rather than asserted from configuration, and what evidence a sandbox boundary should produce.
Operations
Dashboards
Metrics, event groupings, and alert ideas for Claude Code and Agent SDK observability dashboards.
Freshness
Updates
A freshness surface tracking Claude Code changes that affect session logs, transcript handling, hooks, telemetry, and audit review.
Cost evidence
Token Usage
How to read Claude Code token fields in transcripts and telemetry, estimate cost, and avoid treating local estimates as invoices.
Bibliography
Sources
Annotated source list for Claude Code session logs, Agent SDK session storage, hooks, telemetry, and general log-management guidance.
Source count
21 primary references currently power Claude Logs.
The update register is the freshness surface. Future updates should track official Claude Code changes that affect transcripts, hooks, telemetry, stream output, cost fields, and retention behavior.