AgentSight
AgentSight is a local-first, top/strace-like observability tool for AI agents that uses eBPF and TLS tracing to monitor system-level effects like processes, files, and network activity. It solves the problem of opaque agent behavior by correlating LLM calls with actual system actions, without requiring SDKs or proxies. It is for developers working with CLI-based AI agents such as Claude Code, Codex, or Gemini CLI.
✨ Key features
- Live ranked view of sessions, processes, and resource usage
- Animated replay of agent file operations with agentsight vis
- Captures plaintext LLM traffic at SSL/TLS boundaries without proxy
- Tracks subprocess execution, file access, and system resource use
- Offline pprof profiles for token and cost analysis
- OpenTelemetry GenAI span export over OTLP/HTTP
🎯 Use cases
- Monitor what an AI agent is doing in real time
- Debug agent failures by correlating prompts with system effects
- Analyze token usage and cost across sessions
- Audit data movement and security-sensitive actions
- Profile agent behavior with flamegraphs
📦 Installation
🧰 Requirements: Linux kernel 4.1+ with eBPF support (5.0+ recommended) for recording; sudo access for eBPF; works on Windows/macOS for session analysis without eBPF.
cargo install agentsight
# or: wget https://github.com/eunomia-bpf/agentsight/releases/latest/download/agentsight && chmod +x agentsight
For Homebrew on Linux:
brew tap eunomia-bpf/tap
brew install eunomia-bpf/tap/agentsight
agentsight --version
🚀 Usage
agentsight top
To record a command:
sudo agentsight record -- claude
To replay a repository session:
cd your-repository
agentsight vis
⚠️ Good to know
eBPF capture requires Linux with root privileges; IDE agents like Cursor are not traceable via eBPF and rely on native session files.
❓ FAQ
What permissions does AgentSight need?
For live capture, you need sudo or passwordless sudo to use eBPF. Without it, top falls back to process snapshots and native agent sessions. The monitored agent runs as your normal user.
What is the performance impact?
The evaluation reports less than 3% CPU overhead for typical traced agent workloads.
Where does captured data go?
Record sessions are saved as agentsight-*.db SQLite files in the current directory. Monitor stores weekly DBs under ~/.agentsight/monitor. Treat logs and DBs as sensitive.
Why doesn't AgentSight capture traffic from Claude Code or Node.js?
These apps statically link their SSL library, so sslsniff can't hook it by default. AgentSight handles this by auto-discovering the binary with record -- <command> or record -c node.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.