Show HN: AgentSight – eBPF observability for AI agents, no code changes
AgentSight AgentSight is a zero-instrumentation AI Agent observability tool based on eBPF. It captures LLM API calls, Token consumption, and process behavior at the kernel level without modifying Agent code. Overview AgentSight provides full-stack observability for AI Agents running on Linux: Prerequisites macOS: On macOS, AgentSight provides two commands — trace (trajectory collector that scans local JSONL session files, no eBPF) and serve (Dashboard viewer). All other eBPF-dependent commands are Linux-only. macOS: On macOS, AgentSight provides two commands — trace (trajectory collector that scans local JSONL session files, no eBPF) and serve (Dashboard viewer). All other eBPF-dependent commands are Linux-only. Installation Install the published component with the ANOLISA CLI: # Recommended (system mode required — eBPF needs root) sudo anolisa install agentsight # Alternative (Alinux, requires YUM repo configuration) sudo yum install agentsight # Source build (developers only) cd src/agentsight && make build-all Use make build-all for source builds: it builds the Dashboard frontend, the main binary, and agentsight-enforcer in sequence. Running only make build skips the enforcer, and serve will keep logging AgentSight enforcement unavailable. Use make build-all for source builds: it builds the Dashboard frontend, the main binary, and agentsight-enforcer in sequence. Running only make build skips the enforcer, and serve will keep logging AgentSight enforcement unavailable. Quick Start Use the systemd unit for a normal deployment. It runs eBPF tracing and the Dashboard together and starts the enforcer dependency in the required order: sudo systemctl enable --now agentsight.service sudo systemctl status agentsight.service Open http://localhost:7396 after the service becomes active. Enabling the main unit also keeps AgentSight available after a reboot. The bundled systemd launcher binds the Dashboard to 0.0.0.0. Restrict port 7396 with a firewall or security group before exposing the host to an untrusted network. The service runs as root with a private umask and stores data under /var/log/sysak/.agentsight. Use sudo for CLI queries and Dashboard access commands that read this service-owned data. For foreground troubleshooting, stop the systemd unit first so it does not compete with a second tracer. Then use two terminals and run both commands as root. The second command is not reached if both are entered sequentially because agentsight trace stays in the foreground: sudo systemctl stop agentsight.service # Terminal 1 sudo agentsight trace # Terminal 2: Start Dashboard sudo agentsight serve # Open http://localhost:7396 in browser # Print the Dashboard URL and token; open the URL as your desktop user sudo agentsight dashboard --no-open Localhost access is authentication-free; remote access requires a token, see Dashboard Access & Authentication. Localhost access is authentication-free; remote access requires a token, see Dashboard Access & Authentication. Usage agentsight trace — Start eBPF Tracing Starts kernel-level capture of AI Agent activity. sudo agentsight trace Requires root privileges. Captures SSL/TLS traffic, process events, and file operations. Run sudo systemctl stop agentsight.service before starting a foreground tracer. Requires root privileges. Captures SSL/TLS traffic, process events, and file operations. Run sudo systemctl stop agentsight.service before starting a foreground tracer. agentsight serve — Start API & Dashboard # Default: bind to 127.0.0.1:7396 sudo agentsight serve # Bind to all interfaces (remote access) sudo agentsight serve --host 0.0.0.0 --port 7396 Run serve as the same user that runs trace so both commands resolve the same data directory. Binding to 0.0.0.0 exposes the Dashboard on every interface; restrict network access before using that form. Dashboard Access & Authentication Dashboard token authentication is enabled by default: Localhost access (loopback) bypasses authentication — just open http://127.0.0.1:7396. Remote access requires a token: append ?token=
to the browser URL, or set the Authorization: Bearer
HTTP header. The token is auto-generated on the first serve startup (64 hex characters) and persisted to the .dashboard_token file next to the database (default /var/log/sysak/.agentsight/.dashboard_token); it is reused across restarts. Run sudo agentsight dashboard --no-open to print the service-owned access URL and token, then open the URL as your desktop user. To disable authentication (only recommended on trusted internal networks), set in the config file: { "server": { "auth": { "enabled": false } } } After editing /etc/agentsight/config.json, run sudo systemctl reload agentsight.service to apply the change — no restart needed. API Endpoint List GET /api/docs returns the full API route inventory (method, path, description) so scripts and integrations can discover endpoints; requests to unknown /api/ paths also point to it in the 404 response. curl http://127.0.0.1:7396/api/docs agentsight dashboard — Show Dashboard Access Info Displays the Dashboard URL and auth token, then tries to open a browser. On ECS instances it also prints a security-group configuration guide. # Show URL and token without opening a root-owned browser sudo agentsight dashboard --no-open agentsight summary — Unified Overview Rolls up sessions and Token usage, interruption events grouped by severity, and Tokenless savings for a recent time window — one command for the overall health picture. # Last 24 hours (default) agentsight summary # Last 7 days, JSON output agentsight summary --last 168 --json Data sources degrade independently: a missing database contributes zeros without affecting the rest of the report. Data sources degrade independently: a missing database contributes zeros without affecting the rest of the report. agentsight token — Query Token Usage # Today's usage sudo agentsight token # Weekly comparison sudo agentsight token --period week --compare # JSON output sudo agentsight token --json agentsight audit — Query Audit Events # Recent events agentsight audit # Filter by PID and type agentsight audit --pid 12345 --type llm # Summary statistics agentsight audit --summary agentsight discover — Scan for Agents # Discover running AI Agents agentsight discover # List known Agent types agentsight discover --list-known agentsight interruption — Session Interruption Events Query and manage AI Agent session interruption events. Interruption types: # List interruption events (default: last 24h) agentsight interruption list [--last
] [--type
] [--severity
] # Statistics by type agentsight interruption stats # Count by severity agentsight interruption count # Get a single event by ID agentsight interruption get
# List all interruption events of a session / conversation agentsight interruption session
agentsight interruption conversation
# Mark as resolved agentsight interruption resolve
Configuration Configuration file: /etc/agentsight/config.json (override with --config). Important: User config files replace (not extend) the built-in default rules. Ensure your config includes all Agent rules you need. Important: User config files replace (not extend) the built-in default rules. Ensure your config includes all Agent rules you need. Feature Flags Runtime Limits Agent Framework Integration Conversational Skill (cosh) AgentSight provides a built-in conversational skill for Copilot Shell. Users can query Token usage and audit logs via natural language: "How much Token did I use today?" "Show me today's LLM call records" Token Savings (Tokenless Integration) AgentSight integrates with the Tokenless component to display Token savings data in the Dashboard. No additional configuration needed — if both are installed, savings data appears automatically. Data Management Database Auto-cleanup Default maximum database size: 200 MB. When reached, automatic cleanup triggers. Customize via environment variable: export AGENTSIGHT_GENAI_DB_MAX_SIZE_MB=500 Clear History rm -rf /var/log/sysak/.agentsight # Then restart AgentSight FAQ Q: Why can't I see Token data for OpenClaw? A: AgentSight monitors the openclaw-gateway daemon. Check client-gateway connectivity. If you see "pairing required" errors, run openclaw devices approve. Q: Why does the Token savings page show 0? A: Possible causes: (1) The AK/SK authentication mode is not yet supported; (2) Session ID format is non-standard UUID. Q: Why do cumulative savings exceed the single-call difference? A: Agents include historical messages in context. Savings accumulate across turns, so cumulative savings exceed per-turn differences.