Docs/Get started

Grapim and the tools you already have

What Claude Code, Cursor, GitHub Copilot and Entire already record about AI-written code, what Grapim adds, and when you do not need Grapim.

Agent tools and GitHub already keep some records of AI-written code. This page lists what each one records, from its own documentation, and where Grapim differs. Sources were read on 13 November 2026, and the products change often, so check the linked page before relying on a detail.

#Short answer

• One person, one agent, no audit coming: your agent's checkpoints and git are enough. You do not need Grapim.
• Only GitHub Copilot's cloud agent: GitHub already stops the person who asked for a pull request from approving it, and logs the agent's sessions. You probably do not need Grapim.
• A team using several agents on their own machines (Claude Code, Codex, Cursor, Gemini CLI), with an auditor or customer who asks who reviewed AI changes: this is the gap Grapim fills.

#What each tool records

#Claude Code

Claude Code takes a checkpoint before each prompt, and /rewind (or Esc twice) restores files to one. Its documentation is direct about the limits: a file changed only by Bash commands is not tracked, edits made outside Claude or by other sessions are not tracked, checkpoints are deleted about 30 days after the session last saved one, and they are "not a replacement for version control" (Checkpointing).

By default Claude Code adds a Co-Authored-By: … <noreply@anthropic.com> line to its commits and a "Generated with Claude Code" line to pull requests. Both can be turned off with the attribution setting (Settings).

What Grapim adds: a record your whole team shares and keeps after the session ends. Each run is tied to the lines it wrote in each commit, and a teammate approves it before the pull request check passes. Grapim's undo works across sessions and agents. Like checkpoints, Grapim records edits made through the agent's file tools: a file changed only by a shell command is not attributed to the run, and its lines count as unknown or human in the commit.

#Cursor

Cursor's Agent creates checkpoints automatically. They are "stored locally and separate from Git", restoring one "reverts files only", and Cursor says to use them only for undoing Agent changes (Checkpoints). On the Enterprise plan, Cursor Blame labels lines as Tab, Agent or Human, using data from Cursor's servers, for changes Cursor tracked (Cursor Blame). Cursor also proposed Agent Trace, an open format for line attribution (agent-trace.dev).

What Grapim adds: one record across Cursor and the other agents your team uses, a review by someone other than the run's author, and a check that can block merging.

#GitHub Copilot cloud agent

For its own cloud agent (formerly the coding agent), GitHub prevents the person who asked Copilot to create a pull request from approving it. The agent cannot approve or merge, and pushes only to its own copilot/ branches (Risks and mitigations). Administrators get session logs and audit log events marked actor_is_agent (Agentic audit log events). The audit log "does not include client session data, such as the prompts a user sends to Copilot locally" (Review audit logs). The agent control plane shows enterprise agent sessions for the last 24 hours (changelog).

What Grapim adds: the same separation of author and reviewer, for agents that run on developers' machines, whose commits GitHub sees under a person's account. If your team only uses Copilot's cloud agent, GitHub's controls may be all you need.

#Entire

Entire's CLI records agent sessions as checkpoints linked to commits: prompts, transcript, tool activity, changed files and line-level attribution, stored in git refs (refs/entire/checkpoints/…) and marked by an Entire-Checkpoint trailer (Checkpoints, storage). Entire also hosts code, and its Trails have gates: a minimum number of human approvals, whether the author's approval counts, findings and CI checks. Entire's documentation says these gates do not use GitHub's branch protection rules (Gates). The core is free, with agent usage billed per token (Pricing).

How Grapim differs: Grapim leaves your code and your merge process on GitHub. Reviews happen in the hub or from the button on the pull request check, the gate is a GitHub check your branch rule requires, and the reports and audit evidence are built for an engineering manager and an auditor. If your team moves its review flow onto Entire, its gates may cover you.

#What no tool proves

Records depend on the machines that write them. A trailer can be removed, a local tool can be turned off, and an approval on GitHub shows that an account clicked Approve, not that a person read the lines. Grapim records which run wrote each line and which teammate approved that run in the hub. It cannot stop someone who changes their own client to write false records (what the check proves). No standard (SOC 2, ISO 27001, PCI DSS) requires a specific AI-code tool. What auditors sample is change management: who approved a change, and when.

#See your own numbers first

Link the GitHub App and Grapim reads the last 90 days of your merged pull requests. It counts how many had commits from AI agents, and how many of those were merged without an approval from someone other than the author. It installs nothing in your repos.