AgentSight is simply a zero-instrumentation AI Agent observability instrumentality based connected eBPF. It captures LLM API calls, Token consumption, and process behaviour astatine the kernel level without modifying Agent code.
AgentSight provides full-stack observability for AI Agents moving connected Linux:
| Token depletion analysis | Multi-dimensional Token accounting by agent, task, and model |
| Behavior audit | Complete tracing of LLM calls and process execution |
| Dashboard visualization | Web UI for real-time Token trends, Agent health, and convention traces |
| Agent auto-discovery | Automatic discovery of moving AI Agent processes |
| Interruption detection | Detection of LLM errors, SSE truncation, discourse overflow, and crashes |
| External log export | Supports exporting system events to outer log services |
| OS | Linux |
| Kernel | >= 5.8 (BTF support required) |
| Privileges | root aliases CAP_BPF (for eBPF probes) |
| ANOLISA earthy package | Linux x86_64, strategy mode |
macOS: On macOS, AgentSight provides 2 commands — trace (trajectory collector that scans section JSONL convention files, nary eBPF) and service (Dashboard viewer). All different eBPF-dependent commands are Linux-only.
Install the published constituent pinch the ANOLISA CLI:
Use make build-all for root builds: it builds the Dashboard frontend, the main binary, and agentsight-enforcer successful sequence. Running only make build skips the enforcer, and service will support logging AgentSight enforcement unavailable.
Use the systemd portion for a normal deployment. It runs eBPF tracing and the Dashboard together and starts the enforcer dependency successful the required order:
Open http://localhost:7396 aft the work becomes active. Enabling the main portion besides keeps AgentSight disposable aft a reboot.
The bundled systemd launcher binds the Dashboard to 0.0.0.0. Restrict port 7396 pinch a firewall aliases information group earlier exposing the big to an untrusted network.
The work runs arsenic guidelines pinch a backstage umask and stores information under /var/log/sysak/.agentsight. Use sudo for CLI queries and Dashboard access commands that publication this service-owned data.
For foreground troubleshooting, extremity the systemd portion first truthful it does not compete pinch a 2nd tracer. Then usage 2 terminals and tally some commands as root. The 2nd bid is not reached if some are entered sequentially because agentsight trace stays successful the foreground:
Localhost entree is authentication-free; distant entree requires a token, spot Dashboard Access & Authentication.
agentsight trace — Start eBPF Tracing
Starts kernel-level seizure of AI Agent activity.
Requires guidelines privileges. Captures SSL/TLS traffic, process events, and record operations. Run sudo systemctl extremity agentsight.service earlier starting a foreground tracer.
agentsight service — Start API & Dashboard
Run service arsenic the aforesaid personification that runs trace truthful some commands resoluteness the same information directory. Binding to 0.0.0.0 exposes the Dashboard connected every interface; restrict web entree earlier utilizing that form.
Dashboard Access & Authentication
Dashboard token authentication is enabled by default:
- Localhost access (loopback) bypasses authentication — conscionable unfastened http://127.0.0.1:7396.
- Remote access requires a token: append ?token=<TOKEN> to the browser URL, aliases group the Authorization: Bearer <TOKEN> HTTP header.
- The token is auto-generated connected the first service startup (64 hex characters) and persisted to the .dashboard_token record adjacent to the database (default /var/log/sysak/.agentsight/.dashboard_token); it is reused crossed restarts.
- Run sudo agentsight dashboard --no-open to people the service-owned entree URL and token, past unfastened the URL arsenic your desktop user.
To disable authentication (only recommended connected trusted soul networks), group successful the config file:
After editing /etc/agentsight/config.json, tally sudo systemctl reload agentsight.service to use the alteration — nary restart needed.
GET /api/docs returns the afloat API way inventory (method, path, description) truthful scripts and integrations tin observe endpoints; requests to chartless /api/ paths besides constituent to it successful the 404 response.
agentsight dashboard — Show Dashboard Access Info
Displays the Dashboard URL and auth token, past tries to unfastened a browser. On ECS instances it besides prints a security-group configuration guide.
agentsight summary — Unified Overview
Rolls up sessions and Token usage, interruption events grouped by severity, and Tokenless savings for a caller clip model — 1 bid for the wide wellness picture.
Data sources degrade independently: a missing database contributes zeros without affecting the remainder of the report.
agentsight token — Query Token Usage
agentsight audit — Query Audit Events
agentsight observe — Scan for Agents
agentsight interruption — Session Interruption Events
Query and negociate AI Agent convention interruption events.
Interruption types:
| llm_error | HTTP position >= 400 aliases SSE assemblage contains error | high |
| sse_truncated | SSE watercourse ended without finish_reason=stop | high |
| context_overflow | Context magnitude exceeded | high |
| agent_crash | Agent process vanished mid-session | critical |
| token_limit | finish_reason=length pinch output adjacent max | medium |
Configuration file: /etc/agentsight/config.json (override pinch --config).
Important: User config files replace (not extend) the built-in default rules. Ensure your config includes each Agent rules you need.
| Token stats | features.token_stats | true | Core Token accounting |
| SQLite storage | features.sqlite_storage.enabled | true | Local persistence |
| Interruption detection | features.interruption_detection.enabled | true | Error/crash detection |
| Audit | features.audit | true | LLM telephone audit |
| Session mapping | features.session_mapping.enabled | true | responseId→sessionId |
| event_channel_capacity | 10,000 | Probe arena bounded transmission capacity |
| pending_genai_max_count | 1,000 | Max events awaiting session_id |
| max_connection_body_mb | 8 | Single HTTP relationship assemblage buffer limit |
| ring_buffer_mb | 32 | eBPF Ring Buffer size (must beryllium powerfulness of 2) |
Agent Framework Integration
Conversational Skill (cosh)
AgentSight provides a built-in conversational accomplishment for Copilot Shell. Users tin query Token usage and audit logs via earthy language:
- "How overmuch Token did I usage today?"
- "Show maine today's LLM telephone records"
Token Savings (Tokenless Integration)
AgentSight integrates pinch the Tokenless constituent to show Token savings information successful the Dashboard. No further configuration needed — if some are installed, savings information appears automatically.
Default maximum database size: 200 MB. When reached, automatic cleanup triggers.
Customize via situation variable:
Q: Why can't I spot Token information for OpenClaw?
A: AgentSight monitors the openclaw-gateway daemon. Check client-gateway connectivity. If you spot "pairing required" errors, tally openclaw devices approve.
Q: Why does the Token savings page show 0?
A: Possible causes: (1) The AK/SK authentication mode is not yet supported; (2) Session ID format is non-standard UUID.
Q: Why do cumulative savings transcend the single-call difference?
A: Agents see humanities messages successful context. Savings accumulate crossed turns, truthful cumulative savings transcend per-turn differences.
English (US) · 
Indonesian (ID) · 
