eunomia-bpf/agentsight

AgentSight – System‑wide observability for AI agents

What it is – AgentSight is a local‑first monitoring tool that watches AI agents the way top or strace watches ordinary processes. It uses eBPF (and TLS traffic tracing) to capture, in real time, the prompts, model calls, tool invocations, file accesses, network requests, and resource usage that an agent generates on your machine. No SDK, proxy, or code changes are required; the tool works with closed‑source CLIs such as Claude Code, Gemini CLI, OpenCode, etc.

Why it matters – Existing LLM observability platforms (LangSmith, Helicone, etc.) only see what the application reports. They miss the system‑level effects of an agent: spawned subprocesses, file writes, network destinations, and even the plaintext payloads that pass through TLS libraries. AgentSight fills that gap by instrumenting the kernel, giving you a trustworthy, end‑to‑end view of what an agent actually does.

Key capabilities

• Live view (agentsight top) – Ranked list of active sessions showing model usage, token counts, process families, tool calls, file and network activity.
• Replay/visualisation (agentsight vis) – Generates animated GIF/HTML “Agent Nebula” replays of file operations across a repository and semantic flame‑graphs of agent call stacks.
• Recording (agentsight record -- <cmd>) – Runs a command under eBPF capture, storing all events in an SQLite agentsight‑*.db file.
• Reporting (agentsight report …) – Query saved runs for prompts, token usage, audit trails, or export data for dashboards.
• Web UI – Live dashboard (process tree, timeline, metrics) at http://127.0.0.1:7395.
• OpenTelemetry export – Emits GenAI spans (gen_ai.*) over OTLP/HTTP for integration with observability back‑ends.

Supported agents (no extra setup) – Claude Code, Gemini CLI, Kimi Code, Grok Build, Python‑based agents (aider, open‑interpreter, …), Docker containers, Cursor IDE (via native session files), CodeBuddy CLI, and any arbitrary command.

Installation –

• cargo install agentsight (Rust toolchain) or download a pre‑built binary from the GitHub releases page.
• Homebrew formula available for Linux (brew tap eunomia-bpf/tap && brew install agentsight).
• Docker image provided for isolated environments (requires privileged host access for eBPF).

Typical workflow

1. Start a live monitor – agentsight top (sudo if eBPF is needed).
2. Record a specific run – sudo agentsight record -- claude (or replace claude with any command).
3. Analyse – agentsight report token --group-by dir to see token spend per project, or agentsight vis to generate a visual replay.
4. Export / integrate – agentsight report export -o snapshot.json or agentsight debug trace --otel --otel-endpoint http://localhost:4318.

Performance & privacy – The authors report < 3 % CPU overhead for typical workloads. Captured data (prompts, file paths, network targets) is stored locally in SQLite files and should be treated as sensitive.

Getting help – The repo includes a FAQ, detailed docs for building, agent‑specific quirks, and contribution guidelines. The project is MIT‑licensed and actively maintained (CI badges, arXiv paper, ACM DOI).