StackMap
Subscribe
Explore / agentsight
eunomia-bpf

agentsight

System-level observability for AI agents via eBPF and TLS tracing: correlates prompts and model calls with the processes, files and network the agent actually touched — no SDK, no proxy.

671 101 C MITupdated today
securitycodinglocal
View on GitHubDispute this mapping →
Curator's take

Use it when the agent is a closed CLI (Claude Code, Codex, Gemini CLI, OpenClaw) and its own logs don't explain a failure: AgentSight watches at the kernel boundary, so it sees the model traffic *and* every exec, file write and outbound connection, and ties them together. That's the layer LangSmith-class tools can't reach without owning the app code. NOT for prompt/eval-level tracing of an app you wrote (use an OTLP tracer), and it's Linux-with-eBPF: on macOS you're out of luck. Not an enforcement tool — it observes and advises, it doesn't block.

Mapped by ShipWithAI editors · links verified

Continue your stack

What teams reach for next — and why each earns a place beside agentsight. Ranked by curator confidence.

pairs wellalternativealternativealternativealternativeabtopnumbatfailproofaiLangSmithAdrianagentsight
pairs wellalternativebuilt withpick a node for the why · open it from the panel
Weekly digest
README.md2 min read

AgentSight: System-wide AI agent profiling and monitoring with eBPF

License: MIT CI arXiv:2508.02736 DOI:10.1145/3766882.3767169

English | 中文

AI agents can run commands, rewrite files, spawn processes, and contact remote services—but when a run fails, stalls, or behaves unexpectedly, their logs rarely tell the whole story.

AgentSight is a local-first top/strace-like observability tool for AI agents. It connects prompts, model calls, and tool decisions to their real effects on your machine.

  • See what the agent is doing now. Monitor active sessions, processes, resource, model and tool calls, file and network activity.
  • Understand failures and improve agent behavior. Connect prompts and skills to errors, then turn them into better instructions and skills.
  • Find where time, tokens, and resources go. Spot slow steps, retry loops, repeated model or tool calls, token-heavy sessions, and resource-hungry processes.
  • Audit data movement and security-sensitive effects. See which services received requests, which files changed, and whether agents stayed and give safety/security suggestions.
  • Use it with your existing agents. Run AgentSight around Claude Code, Codex, Gemini CLI, OpenCode, OpenClaw, or any command—without an SDK, proxy, or vendor integration.

No SDK, no proxy, no vendor integration. AgentSight observes with eBPF and TLS traffic tracing, so it works even when the agent is a closed-source CLI. ✨ Zero SDK Required

Quick Start

cargo install agentsight
# or: wget https://github.com/eunomia-bpf/agentsight/releases/latest/download/agentsight && chmod +x agentsight
AgentSight top live session view

Live sessions ranked by model, session tokens, health, process family, tool calls, file activity, and network activity

agentsight top
Agent Nebula replay of Agent development across the ACTplane repository

Agent Nebula replays how coding agents read, write, create, rename, and delete files across the ACTplane repository

agentsight vis
Semantic flamegraph of the top 200 agent stacks

Width is system-effect weight; the uneven stack height shows prompt, tool-call, process, and effect paths ending at different depths. See the agentpprof guide for the other profiles and how widths and stack depths are drawn.

🚀 Why AgentSight?

Traditional Observability vs. System-Level Monitoring

Application-level tools such as LangSmith, Langfuse, and Phoenix are great for traces, prompts, tokens, evals, and latency when you own the application code. Gateway/proxy tools such as Helicone are useful when you can route provider traffic through a managed endpoint.