AgentSight is a local-first observability tool for AI agents that works like top or strace for agent runs. It connects prompts, model calls, and tool decisions to what they actually did on the machine: the processes spawned, the files read and written, and the network requests sent.
It observes agents from outside, with eBPF and TLS traffic tracing, so it needs no SDK, proxy, or vendor integration and works with closed-source CLI agents. Captured events come from the kernel rather than from the agent's own logs, which the agent could leave incomplete or modify. On Windows, macOS, or Linux without eBPF, the live, replay, and report views fall back to the agents' native session files.
| Challenge | Application-level tools | AgentSight |
|---|---|---|
| Framework adoption | SDK, callback, or gateway integration per app | System tracer, no code changes |
| Closed-source CLIs | Limited to what the tool exposes or logs | Observes existing binaries from outside |
| Agent-controlled logs | Logs can be incomplete, disabled, or modified | Kernel-level events independent of app logging |
| TLS LLM traffic | Visible when routed through SDKs or proxies | Captures plaintext at SSL/TLS calls without a proxy |
| System actions | Often misses subprocesses and file activity | Tracks process execution, file access, and resource use |
Application-level tools such as LangSmith, Langfuse, and Phoenix trace prompts, tokens, and evals when you own the application code, and gateway tools such as Helicone see traffic routed through them. AgentSight targets the system boundary those tools miss. Supported agents include Claude Code, Codex, Gemini CLI, Kimi Code, OpenCode, OpenClaw in Docker containers, Python agents such as Aider, Cursor (through its local sessions), CodeBuddy CLI, and any other command. A Rust library exposes the same capture runners, event model, and sinks to other applications.
Features
- Live session view: active sessions ranked by model, session tokens, health, process family, tool calls, file activity, and network activity
- Recording and reports: recorded sessions are stored in SQLite and queried for prompts, token usage, and an audit of process spawns, file opens, and API calls
- Web interface: an overview dashboard plus timeline, process tree, event log, and CPU and memory metrics views for live or saved sessions
- Agent Nebula replay: an animated replay of how coding agents read, write, create, rename, and delete files across a repository
- Semantic flamegraphs: agentpprof profiles of local Codex and Claude session history, aggregated by project, agent, prompt, model, and token kind
- TLS capture: reads plaintext LLM payloads at SSL/TLS call boundaries, including agents that statically link their SSL library
- OpenTelemetry export: captured LLM calls exported as OpenTelemetry GenAI spans over OTLP/HTTP
- Background monitoring: an optional service keeps monitoring running across sessions
- Low overhead: the project's evaluation reports under 3% CPU overhead for typical traced agent workloads
