agentsight vs OrcaReplay
System-level observability for AI agents via eBPF and TLS tracing: correlates prompts and model calls with the processes, files and network the agent actually touched — no SDK, no proxy. — versus — Time travel for coding agents: a local proxy records any run (Claude Code, Codex, SDKs, even TLS-only harnesses), replays it byte-for-byte offline, and forks from any step onto a different model.
Both observe agents below the SDK boundary (eBPF/TLS vs proxy/TLS intercept); agentsight correlates for monitoring, OrcaReplay records to reproduce.
| agentsight | OrcaReplay | |
|---|---|---|
| Stars | 681 | 214 |
| Forks | 101 | 66 |
| Language | C | TypeScript |
| License | MIT | Apache-2.0 |
| Last activity | 4 days ago | yesterday |
| Topics | security, coding, local | evals, coding |
| Curated connections | 6 | 5 |
agentsight — the curator's take
Use it when the agent is a closed CLI (Claude Code, Codex, Gemini CLI, OpenClaw) and its own logs don't explain a failure: AgentSight watches at the kernel boundary, so it sees the model traffic *and* every exec, file write and outbound connection, and ties them together. That's the layer LangSmith-class tools can't reach without owning the app code. NOT for prompt/eval-level tracing of an app you wrote (use an OTLP tracer), and it's Linux-with-eBPF: on macOS you're out of luck. Not an enforcement tool — it observes and advises, it doesn't block.
OrcaReplay — the curator's take
This is the debugger, not the dashboard: `orca record claude` captures the full loop below the agent (requests, streamed responses, tool calls, shell exit codes, file writes), `orca replay last` reproduces it with zero tokens, and `--from N --model X` makes the model the only variable so A/B comparisons actually mean something. Use it to answer 'why did it delete my migration' and to benchmark models on a real run. Skip it for cost/latency observability (failproofai, numbat, agentsight do that) or for agents you can't put behind a proxy or TLS intercept. Small and young (~200 stars); the trace spec is CC-BY, the default endpoint is the maintainers' OrcaRouter — swap it if that matters.