The CLI knew I wasn't human

That showed up in my terminal last week. It's an apology, addressed to me, for the inconvenience of my being a person.

The tool is Bluebox, a new Dynatrace product that gives coding agents like Claude Code access to production data, so the agent can check what a service did instead of guessing. I meant to install it, poke around, move on. Instead I got the strangest onboarding I've ever read, and a bug report I'm glad I never sent.

Why was I reading the installer at all? I teach kids never to run code they haven't read, so piping curl into bash isn't something I get to do anymore. The Bluebox script turned out to be 120 clean lines, same shape as the rustup installer, no tricks. Reading it made me feel responsible right up until I understood that its whole job is fetching a 24.6 MB compiled binary I can't read at all. So the audit was a ritual. A nice one. You're trusting the vendor either way; reading the script just means you do it with your eyes open.

It talks to my agent when I'm not looking

The moment I ran the thing, it noticed Claude Code in my environment and stopped speaking English. No wizard, no prompts. It handed my agent a JSON contract and instructions for driving the whole setup itself, and honestly, this vendor writes better boundaries into machine output than most tools write into their docs:

There's a whole hidden layer of this. Every setup phase runs read-only first and asks before writing. The agent gets told, in plain text, not to make decisions on my behalf. Somebody at Dynatrace has watched an agent go rogue with a setup loop and decided never again.

Claude treated all of it as suspicious anyway and kept stopping to check with me, so my terminal briefly became two coworkers who don't fully trust each other, being carefully polite while they set up software on my machine. I got bounced to the browser twice, once to type a device code and once to click through GitHub screens, and I found that oddly reassuring. The robots can do a lot now. "Authorize" is still my button.

lines of installer, read before running

120

MB of binary that reading it does not cover

24.6

repositories scaffolded

37

skill files written to disk

148

bytes of telemetry when setup said complete

0

I almost filed a fake bug

The repo scanner looked broken, and I had evidence. Point it at my projects folder with forward slashes: "no git repositories found," in three milliseconds, with 37 repos sitting right there. Backslashes: invalid JSON. Claude had a bug report drafted and I had the support address open.

Then I applied my own rule: reproduce it before you believe it. On a clean retest the scan worked perfectly. All 37 repos, correct stack detection, everything.

Nothing in that loop would have caught it except a human demanding proof, and that habit only gets more important as more of my tooling starts talking to other people's tooling on my behalf.

In my defense, a path the tool can't walk should be an error, not a cheerful "found nothing" in three milliseconds. That little lie is why the wrong story survived twenty minutes.

"Setup complete," it said, measuring nothing

All five phases green. Zero telemetry flowing. Setup doesn't instrument anything, it turns out; it leaves templates behind and teaches your agent to do the real work later, one repo at a time. A defensible design wearing the wrong label. A green checkmark that means nothing is my least favorite thing in software, and "complete" while measuring zero bytes will burn somebody who assumes their service is now visible.

Then I used it on a real repo

The repo I picked is agent-trace-gate, my runtime checkpoint gate: it runs AI-generated code in instrumented sandboxes and blocks hallucinated imports and fake APIs before they merge. Python parent, Python and Node children. The children turned out to be where the story was.

The instrumentation skill wouldn't start until I chose what to collect, and it never touched my API token, wiring the app to read it from the environment and leaving the pasting to me. Good manners. Then it surfaced an actual bug in my code, as opposed to the fake one I nearly reported: the sandbox hands children a scrubbed environment, and the scrub was eating the OTLP auth header, so every sandbox span would have been rejected with a 401 that nothing ever surfaces. That's the kind of silent failure that pages somebody at 3 a.m. The fix now lives in the repo with its own little confession:

# OTLP transport config the child's own SDK reads straight from the
# environment. The ingest token lives in the header var, so a child talking to
# an authenticated backend (Bluebox) is rejected without this passthrough.
_KEEP_OTEL_ENV = {
    "OTEL_EXPORTER_OTLP_PROTOCOL",
    "OTEL_EXPORTER_OTLP_HEADERS",
    "OTEL_EXPORTER_OTLP_TRACES_HEADERS",
}

I only caught it because I pointed the app at a local receiver and read the raw output instead of trusting "no errors."

With data flowing, I started asking questions. It confirmed 56 spans across the checkpoint pipeline and both sandbox runtimes, nine log records, both metrics, and that every one of them carried the repo URL and the exact commit it came from. Evidence under every answer, thirty to sixty seconds each. Then it told me my logs were missing trace IDs. They weren't. I had checked those payloads by hand.

Would I keep it? Yeah, so far. The agent-facing design is the best thing here, and "ask the human first" written into machine-readable output should be an industry standard by Friday. The rough edges are all one edge, the tool acting sure where it should hedge. It said OK about a scan that found nothing, complete about a setup that measured nothing, broken about logs that were fine.

Smaller annoyances, quickly: your telemetry lands in a Dynatrace tenant, which nothing mentions and I learned from a config file, and there are two separate credentials that nothing mentions either, so I got "not authenticated" from a tool I'd authenticated to an hour before.

But a coding agent that can answer "what did production actually do last night" without me leaving the terminal? I've wanted that since the first time an AI confidently explained a bug that wasn't there.

Windows 11, Claude Code, 37 local repos, CLI v0.739.0. Tenant and workspace identifiers left out on purpose.