eunomia-bpf/agentsight

system-level profiler/monitor and skills for Agents in eBPF or Mac

What it solves

AgentSight provides system-level observability for AI agents, filling the gap where application-level tools (like LangSmith or Langfuse) fail. It allows developers to monitor what an agent actually does on a machine—such as spawning processes, modifying files, and making network calls—without requiring the agent to have a built-in SDK or proxy. This is particularly useful for closed-source CLI agents where internal logs are limited or unavailable.

How it works

AgentSight uses eBPF (extended Berkeley Packet Filter) and TLS traffic tracing to observe agent activity from the Linux kernel level. It captures plaintext LLM payloads at SSL/TLS call boundaries and correlates these prompts and model responses with real-time system events like process execution and file access. Because it operates at the system boundary, it requires no code changes to the agent being monitored.

Who it’s for

It is designed for developers and security auditors who use AI agents (such as Claude Code, Gemini CLI, or aider) and need to debug failures, audit security-sensitive file/network changes, or analyze token and resource consumption.

Highlights

  • Zero SDK Required: Works with any binary or CLI agent without needing an SDK, proxy, or vendor integration.
  • System-Wide Monitoring: Tracks process trees, file operations, and network activity alongside LLM calls.
  • Live and Offline Analysis: Includes a top-like live view, a web interface for timelines and metrics, and agentpprof for generating semantic flamegraphs of token usage.
  • OpenTelemetry Support: Can export captured LLM calls as standards-compliant GenAI spans via OTLP/HTTP.
  • Low Overhead: Reports less than 3% CPU overhead for typical workloads.