AgentSight
eBPF-based system-level observability for AI agents — see what agents actually do on your machine with zero SDK, proxy, or vendor integration.
- Source repo
- eunomia-bpf/agentsight
- Stars
- ★ 754
- Last updated
- 18d ago
- License
- MIT
- Primary language
- C
- FA score
- 77/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude CodeCodex (Partial support)
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A developer debugging failed or stalled Claude Code/Codex runs who wants to correlate prompts with actual errors and subprocess behavior.
- Not a fit if
- Teams without Linux root access: live eBPF capture needs sudo or CAP_BPF/CAP_SYS_ADMIN
- macOS or Windows users needing full live tracing: non-Linux platforms only read session files
- Teams wanting to trace Cursor-style Electron IDE agents: eBPF cannot capture their TLS or protobuf traffic
- Source review
- 77/100 · Some gaps
What does this agent do, and when should you use it?
AgentSight is a local-first, top/strace-like observability tool for AI agents that connects prompts, model calls, and tool decisions to their real effects on your machine. It works through eBPF kernel probes and TLS traffic tracing, so it can observe closed-source CLIs like Claude Code without any SDK, proxy, or vendor integration. agentsight top gives a live ranked view of sessions by health, token usage, and tool calls; agentsight record persists sessions to SQLite databases; agentsight report answers structured queries; agentsight vis renders animated replays of agent file activity; and agentpprof produces offline pprof-style semantic flamegraphs. The project is MIT-licensed, installable via Cargo, Homebrew, release binaries, or Docker, and exports captured LLM calls as OpenTelemetry GenAI spans.
AgentSight observes existing binaries and CLI agents from outside using eBPF probes and SSL/TLS call-site tracing, with no in-process instrumentation. agentsight top ranks live sessions, processes, model and tool calls, file and network activity; sudo agentsight record -- <command> auto-discovers binaries, SSL libraries, and container processes, captures plaintext LLM payloads, subprocess executions, file operations, and resource use, storing sessions in agentsight-*.db SQLite files; agentsight report provides summaries, token usage (groupable by working directory), audit JSON, a web UI (report serve on port 7395), and snapshot export; agentsight vis scans local Claude/Codex/Gemini sessions and renders an agent-nebula replay GIF; agentpprof aggregates local Codex/Claude sessions by project, agent, session tag, prompt tag, model, and token kind into pprof flamegraphs; debug trace --otel exports LLM calls as GenAI spans over OTLP/HTTP.
- A developer debugging failed or stalled Claude Code/Codex runs who wants to correlate prompts with actual errors and subprocess behavior.
- A team auditing security-sensitive effects: which remote services received requests and which files an agent changed.
- An engineering lead analyzing token cost distribution by project, model, or session using agentpprof's token flamegraphs.
- A maintainer wanting to replay how a coding agent read, wrote, created, renamed, and deleted files across a repository with
agentsight vis. - A team with existing application-level observability (LangSmith/Langfuse) that lacks process- and file-level visibility, using AgentSight as a system-boundary complement and exporting OTel spans to existing backends.
How do you install or deploy this agent?
Install via:
- cargo install agentsight
- or download the release binary: wget https://github.com/eunomia-bpf/agentsight/releases/latest/download/agentsight && chmod +x agentsight
- Homebrew on Linux: brew tap eunomia-bpf/tap && brew install eunomia-bpf/tap/agentsight
- Docker (requires privileged host access) or build from source (see docs/build.md).
Live eBPF capture requires Linux kernel 4.1+ (5.0+ recommended) and sudo; top, bind, vis, and report work without eBPF using agent-native session files.
How do you use this agent?
Key commands:
- agentsight top — live ranked view (enables eBPF automatically when sudo is available)
- sudo agentsight record -- claude — record a command (also gemini, kimi, grok, -c python, -c node --binary-path docker://openclaw, etc.)
- agentsight report / report list / report token --group-by dir / report audit -- — query saved sessions
- agentsight vis — generate a session replay inside a Git worktree (GIF needs local Chromium and FFmpeg; HTML export needs neither)
- Open http://127.0.0.1:7395 for timeline, process tree, event log, and metrics views- sudo ./agentsight debug trace --otel --otel-endpoint http://localhost:4318 for OpenTelemetry export
After a source build, run tests with make test.
What are this agent's strengths and limitations?
- Zero-SDK, zero-proxy design: observes closed-source CLIs (Claude Code, Gemini CLI, etc.) via eBPF and TLS call-site tracing with no application code changes.
- Kernel-level events independent of agent-controlled logs capture subprocess executions, file operations, and plaintext LLM payloads that application-level tools miss.
- Evaluation reports less than 3% CPU overhead for typical traced workloads, with standards-compliant OpenTelemetry GenAI export.
- Rich analysis surfaces: live top view, SQLite persistence, web UI, replay animations, and pprof flamegraphs.
- Live eBPF capture requires Linux and root privileges (sudo or CAP_BPF/CAP_SYS_ADMIN); macOS/Windows are limited to non-eBPF session-file paths.
- Apps with statically linked SSL libraries (BoringSSL in Claude/Bun, OpenSSL in all Node.js) cannot be hooked by sslsniff by default and rely on auto-discovery or
--binary-path. - IDE agents like Cursor cannot be traced via eBPF: Electron apps with TLS inside stripped binaries and protobuf traffic.
- Captured data includes prompts, responses, paths, headers, and network targets, so logs and databases are sensitive and must be managed accordingly.
How does this agent compare with similar options?
The README contrasts AgentSight with application-level tools (LangSmith, Langfuse, Phoenix) and gateway/proxy tools (Helicone): those require SDK, callback, or gateway integration and suit scenarios where you own the application code; AgentSight instead observes existing binaries from the system boundary, capturing subprocess executions, plaintext LLM payloads at TLS call sites, file operations, and cross-boundary behavior — complementary rather than a replacement.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AgentSight This agent | 77 · Some gaps | CLIFree | ★ 754 | 18d ago | C | Claude Code |
| DataBuff | 41 · Major gaps | Self-hosted serviceFree + model costs | ★ 710 | 16d ago | Java | OpenAI API |
| ClawMetry | 81 · Good | CLIFreemium | ★ 436 | 2d ago | Python | Codex · Claude Code |
| OpenInference | 71 · Some gaps | Library / SDKFree | ★ 1.3k | 1d ago | Python | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows a local-first system observability tool: eBPF probes need root, but docs state the monitored agent still runs as the normal user with only probes elevated, and there is a no-sudo fallback to snapshots and native session files (least_privilege=2). Data flow is documented in detail in the FAQ (local SQLite, ~/.agentsight/monitor, localhost web UI), earning high transparency (=3). However, captured content includes plaintext TLS LLM payloads, prompts, headers, and network targets; the docs only advise treating logs as sensitive, with no redaction/encryption or explicit user-confirmation flow, and the monitor can install a background service without a documented consent/undo path (user_confirmation=1, sensitive_data_handling=2, rollback=1). CI uses lockfiles and vendoring, but no audit/vulnerability scanning is shown (=1). Optional OTLP export is an explicit opt-in feature (=2). MIT license, eunomia-bpf attribution, and arXiv paper give clear sourcing (=2). Deductions: sensitive-data protection stays at the advisory level; no confirmation/rollback detail.
README, CI, and tests are mutually consistent: command examples (top/record/report/vis), field names, and test assertions align with one coherent event model (self_consistency=3). Dependencies (cargo/crates.io, npm, Chromium/FFmpeg) are addressed in docs and CI but carry external availability risk, e.g., GIF export needs local Chromium (=2). The FAQ provides troubleshooting guidance and tests use WARN/SKIP soft failure for kernel variance (failure_messages=2). No contradictions found; deduction is that failure handling is FAQ-based rather than systematic error codes/recovery docs.
Clearly targets Claude Code, Codex, Gemini CLI, OpenCode, and arbitrary commands, distinguishing the eBPF path from the agent-native session path (audience_and_scenarios=3). Capability boundaries are unusually honest: Cursor IDE not traceable via eBPF, statically linked SSL capture limits, kernel 4.1+/5.0+ requirements are all stated (capability_boundaries=3). Auto-discovery of binaries and SSL libraries lowers the barrier, but precision depends on explicit -p/--session selectors; default modes capture broadly (=2). Linux/macOS/partial Windows plus Docker are covered with environment-specific notes (environment_fit=3).
Documentation is well structured: Quick Start, Usage, FAQ, Contributing, License with a complete docs/ index (information_architecture=3). Installation covers cargo, Homebrew, binaries, Docker, and source builds with platform differences (install_notes=3). Examples are abundant and consistent with the command table; the FAQ directly addresses permissions, performance, data location, and failure triage (examples_and_faq=3). Known limitations (Cursor, static SSL, unpublished Windows assets) are stated (known_limitations=3). The MIT LICENSE file matches the badge (license=3). Naming is mostly stable (agentsight/agentpprof) though the unsuffixed asset is a vague 'compatibility alias' (=2). Versions are semver-managed by CI, but the release snapshot force-pushes master and changelogs rely on generated notes (versioning_changelog=2). Maintainer is the eunomia-bpf org with a clear release process, but publisher identity is unverified (maintenance_responsibility=2).
Output usability is strong: live top view, web dashboard, report JSON/SQLite queries, standards-based OTel export, and pprof-compatible flamegraphs (output_usability=3). Relative to application-level tools like LangSmith/Langfuse, it fills the system-boundary gap with zero-SDK adoption; the marginal value argument is explicit and differentiated (marginal_value=3). The <3% CPU overhead claim cites a paper but cannot be reproduced in static review, and the eBPF+root+privileged-Docker operational cost is nontrivial for ordinary users (cost_benefit=2).
Most claims trace to in-repo material: the <3% overhead figure points to the arXiv paper and DOI; install/build claims point to docs files; CI steps map to repo paths (claim_traceability=2). README, CI workflows, and bpf tests corroborate the event model and command behavior across three sources (cross_source_corroboration=2). Facts and inference are mostly separated, but promotional framing ('The Future of AI Observability') and the performance number are not distinguished by evidence strength in-text (fact_inference_separation=2). Deduction: no in-repo benchmark data backs the performance claim, and it cannot be verified statically.
- Captured data includes plaintext TLS payloads, prompts, file paths, and network targets, stored by default as SQLite files in the working directory; treat as sensitive and avoid committing or sharing.
- eBPF mode requires root/privileged containers; monitor can install a persistent background service — verify its capture scope and autostart behavior and how to uninstall before deploying.
- The performance claim (<3% CPU overhead) comes from the project's own paper and was not executed or verified in this review; benchmark on your own workload.
- Publisher identity is unverified, and the release flow force-pushes version snapshots to master; audit the release chain before production adoption.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
What's Changed * Restore SSL readiness, exact bytes, HPACK safety, and listener evidence by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/226 * Complete process probe liveness, file paths, and listener fields by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/234 * Extract generic media-kind evidence from HTTP metadata by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/223 Full Changelog: https://github.com/eunomia-bpf/agentsight/compare/v1.0.33...v1.0.34View on GitHub ↗ -
Release notes excerpt
What's Changed * fix: load process probes on newer kernels and isolate root test fixtures by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/231 * feat(bpf): extend process probe inbound socket evidence by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/229 * chore(devcontainer): match CI Rust and Node toolchains by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/230 Full Changelog: https://github.com/eunomia-bpf/agentsight/compare/v1.0.32...v1.0.33View on GitHub ↗ -
Release notes excerpt
What's Changed * Add CodeBuddy CLI support and fix Codex rustls plaintext capture by @sungw666 in https://github.com/eunomia-bpf/agentsight/pull/212 * feat(bpf): trace resolved file access in process probe by @yunwei37 in https://github.com/eunomia-bpf/agentsight/pull/227 New Contributors * @sungw666 made their first contribution in https://github.com/eunomia-bpf/agentsight/pull/212 Full Changelog: https://github.com/eunomia-bpf/agentsight/compare/v1.0.31...v1.0.32View on GitHub ↗
FAQ
What permissions does it need?
top uses live eBPF capture with sudo or cached sudo, otherwise falls back to process snapshots and native agent session files. With record -- <command>, the monitored agent runs as your normal user; only the probes are elevated.What is the performance impact?
Where does captured data go?
record writes agentsight-*.db SQLite files to the current directory by default; monitor stores weekly DBs under ~/.agentsight/monitor; top shows only live sessions. Data includes prompts, responses, and paths, so treat it as sensitive.Why can't it capture Claude Code or Node.js traffic by default?
record -- <command> auto-discovery or --binary-path.Can it trace IDE agents like Cursor?
agentsight top reads its local sessions without sudo).