What EvalGate does and does not do
Everything below runs locally through the CLI. Import, scoring, measures, views and the PDF never open a network connection, never call a model and never read a credential. The coding agent itself still needs the network to reach its model; EvalGate only reads the files it leaves behind. Prompt, response, tool-argument and tool-output content is dropped while decoding, even when the agent was configured to send it. Each agent profile keeps an allowlist of attributes, so a new content-bearing attribute from a vendor is dropped without a code change. The run has no person in it unless you ask for one with--attribute-by person.
1. Capture the agent’s telemetry
Claude Code exports OpenTelemetry over OTLP. Run a local OpenTelemetry Collector with thefile exporter and point Claude Code at it. The full
collector configuration is in the
CLI reference.
--source claude-session. Claude Code treats that format as internal, so
prefer an OTLP capture when the importer reports an unsupported format.
2. Import each run
--apply writes one file per run to
.evalgate/runs/<runId>.json. Use --tier to label the depth of each run so
views can group by it. Inputs are bounded (file size, line size, records,
runs, gzip ratio), and symlinks and FIFOs are refused.
3. Score findings against a reviewed answer key
A person writes the answer key: the facts a complete answer must contain, each with the paths or symbols that prove it. Save the agent’s findings as a JSON array ofclaim, paths and symbols, then score:
4. Compare runs with a view
n/a with its reason and
is never filled with 0. No measure is labelled good or bad.
5. Export the PDF
--hide-labels replaces titles and run ids with letters.
Agent settings that send content
EvalGate drops content at import whatever these settings are. Turn them off at the source too, so content never leaves the developer’s machine in the first place. The Verified column says where each row comes from; rows not confirmed against the vendor’s own documentation say so.
Two things follow from the table. Identity attributes arrive even with every
content setting off, so EvalGate drops
user.email at import and keeps the
organization only as a salted digest. And OTEL_LOG_TOOL_DETAILS is the only
way Claude Code telemetry carries file paths: EvalGate keeps those paths as
salted digests and drops the rest of that payload.
Codex CLI, Gemini CLI and Copilot CLI imports are not available yet; their
rows are listed so you can turn content off before those profiles ship.