eunomia-bpf/agentsight

What it solves

AgentSight provides system-level observability for AI agents, filling the gap where application-level tools (like LangSmith or Langfuse) fail. It allows developers to monitor what an agent actually does on a machine—such as spawning processes, modifying files, and making network calls—without requiring the agent to have an SDK, proxy, or vendor integration. This is particularly useful for closed-source CLI agents where internal logs are limited or missing.

How it works

AgentSight uses eBPF (Extended Berkeley Packet Filter) and TLS traffic tracing to observe agent behavior from the kernel level. It captures plaintext LLM payloads at SSL/TLS call boundaries and correlates these model calls with system events like process execution and file access. Because it operates at the system boundary, it can trace binaries and CLI agents without modifying their code.

Who it’s for

Developers and security auditors who need to monitor AI agents (such as Claude Code, Gemini CLI, or custom Python-based agents) to debug failures, analyze token usage, audit data movement, and ensure agents are behaving safely within the system.

Highlights

• Zero SDK Required: Works with existing binaries and closed-source CLIs without code changes or proxies.
• System-Wide Monitoring: Tracks process trees, file operations, and network activity alongside LLM prompts and responses.
• Rich Visualization: Includes a top-like live view, animated replays of file changes, and semantic flamegraphs for cost and performance analysis.
• OpenTelemetry Support: Can export captured LLM calls as GenAI spans via OTLP/HTTP for integration with other telemetry backends.
• Low Overhead: Reports less than 3% CPU overhead for typical agent workloads.