Skip to main content
Agents and dependencies generate and execute code you didn’t write — in your CI, with the same access to your secrets as your own code. That risk started with the supply chain; agents make it the default. The diff shows what changed. It doesn’t show what ran. The gap lands on code review: more PRs, and no way to verify from the diff what a change actually did. Garnet fits into that review step — it records the execution chains and outbound connections of the run, at the kernel, on the GitHub ubuntu-latest runners you already use, and posts the record to the pull request before anyone approves.
A recorded Garnet comment comparing two commits: the job row leads with +1 −0 and the tree marks one added destination, httpbin[.]org, reached from a postinstall hook

The diff added a postinstall hook. The run reached a host the diff never names.

The product today is three pieces: the GitHub App connects your repos, the Garnet Action instruments the workflows you want recorded, and the comment on the PR — an Execution Profile per job — is the output. Two consumers, both first-class:

Human reviewers

Add Garnet to your CI — your first Execution Profile in about five minutes.

Agentic reviewers & harnesses

Review agents and verification gates that consume the record as an input.
Garnet records the run. The policy stays yours.