Skip to main content
Capture every tool call Claude Code makes — file reads, writes, bash commands, and more — with zero changes to your workflow.

​
Setup

Install provenlog: 
pip install provenlog
Add hooks to your Claude Code settings. Either edit .claude/settings.json (project) or ~/.claude/settings.json (global): 
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          { "type": "command", "command": "provenlog-hook" }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          { "type": "command", "command": "provenlog-hook", "async": true }
        ]
      }
    ],
    "PostToolUseFailure": [
      {
        "matcher": ".*",
        "hooks": [
          { "type": "command", "command": "provenlog-hook", "async": true }
        ]
      }
    ]
  }
}
Restart your Claude Code session after adding hooks.
You can also ask Claude Code directly: “Add provenlog hooks to my settings — use the provenlog-hook command for PreToolUse, PostToolUse, and PostToolUseFailure”

​
What gets captured

Every tool call is captured to ~/.provenlog/events.db:
EventAction TypeDetails
Pre-tool useTOOL_CALLTool name, input arguments
Post-tool useTOOL_RESULTTool output, success/failure
Tool failureTOOL_RESULTError message, failure details

​
How it works

The provenlog-hook command reads Claude Code’s hook event data from stdin, converts it to a ProvenLogEvent, and writes it to the local SQLite database. The hook runs synchronously for PreToolUse (so it can block if needed) and asynchronously for PostToolUse and PostToolUseFailure (to avoid slowing down Claude Code).

​
Querying hook events

# View recent Claude Code tool calls
plog log --last 20

# Verify the hash chain
plog verify --agent-id claude-code

# Start the dashboard to explore visually
plog serve