AgentSight is a zero-instrumentation AI Agent observability tool based on eBPF. It captures LLM API calls, Token consumption, and process behavior at the kernel level without modifying Agent code.

AgentSight provides full-stack observability for AI Agents running on Linux:

macOS: On macOS, AgentSight provides two commands — trace (trajectory collector that scans local JSONL session files, no eBPF) and serve (Dashboard viewer). All other eBPF-dependent commands are Linux-only.

Install the published component with the ANOLISA CLI:

# Recommended (system mode required — eBPF needs root)
sudo anolisa install agentsight

# Alternative (Alinux, requires YUM repo configuration)
sudo yum install agentsight

# Source build (developers only)
cd src/agentsight && make build-all

Use make build-all for source builds: it builds the Dashboard frontend, the main binary, and agentsight-enforcer in sequence. Running only make build skips the enforcer, and serve will keep logging AgentSight enforcement unavailable.

Use the systemd unit for a normal deployment. It runs eBPF tracing and the Dashboard together and starts the enforcer dependency in the required order:

sudo systemctl enable --now agentsight.service
sudo systemctl status agentsight.service

Open http://localhost:7396 after the service becomes active. Enabling the main unit also keeps AgentSight available after a reboot.

The bundled systemd launcher binds the Dashboard to 0.0.0.0. Restrict port 7396 with a firewall or security group before exposing the host to an untrusted network.

The service runs as root with a private umask and stores data under /var/log/sysak/.agentsight. Use sudo for CLI queries and Dashboard access commands that read this service-owned data.

For foreground troubleshooting, stop the systemd unit first so it does not compete with a second tracer. Then use two terminals and run both commands as root. The second command is not reached if both are entered sequentially because agentsight trace stays in the foreground:

sudo systemctl stop agentsight.service

# Terminal 1
sudo agentsight trace

# Terminal 2: Start Dashboard
sudo agentsight serve
# Open http://localhost:7396 in browser

# Print the Dashboard URL and token; open the URL as your desktop user
sudo agentsight dashboard --no-open

Localhost access is authentication-free; remote access requires a token, see Dashboard Access & Authentication.

Starts kernel-level capture of AI Agent activity.

Requires root privileges. Captures SSL/TLS traffic, process events, and file operations. Run sudo systemctl stop agentsight.service before starting a foreground tracer.

# Default: bind to 127.0.0.1:7396
sudo agentsight serve

# Bind to all interfaces (remote access)
sudo agentsight serve --host 0.0.0.0 --port 7396

Run serve as the same user that runs trace so both commands resolve the same data directory. Binding to 0.0.0.0 exposes the Dashboard on every interface; restrict network access before using that form.

Dashboard token authentication is enabled by default:

• Localhost access (loopback) bypasses authentication — just open http://127.0.0.1:7396.
• Remote access requires a token: append ?token=<TOKEN> to the browser URL, or set the Authorization: Bearer <TOKEN> HTTP header.
• The token is auto-generated on the first serve startup (64 hex characters) and persisted to the .dashboard_token file next to the database (default /var/log/sysak/.agentsight/.dashboard_token); it is reused across restarts.
• Run sudo agentsight dashboard --no-open to print the service-owned access URL and token, then open the URL as your desktop user.

To disable authentication (only recommended on trusted internal networks), set in the config file:

{
  "server": { "auth": { "enabled": false } }
}

After editing /etc/agentsight/config.json, run sudo systemctl reload agentsight.service to apply the change — no restart needed.

GET /api/docs returns the full API route inventory (method, path, description) so scripts and integrations can discover endpoints; requests to unknown /api/ paths also point to it in the 404 response.

curl http://127.0.0.1:7396/api/docs

Displays the Dashboard URL and auth token, then tries to open a browser. On ECS instances it also prints a security-group configuration guide.

# Show URL and token without opening a root-owned browser
sudo agentsight dashboard --no-open

Rolls up sessions and Token usage, interruption events grouped by severity, and Tokenless savings for a recent time window — one command for the overall health picture.

# Last 24 hours (default)
agentsight summary

# Last 7 days, JSON output
agentsight summary --last 168 --json

Data sources degrade independently: a missing database contributes zeros without affecting the rest of the report.

# Today's usage
sudo agentsight token

# Weekly comparison
sudo agentsight token --period week --compare

# JSON output
sudo agentsight token --json

# Recent events
agentsight audit

# Filter by PID and type
agentsight audit --pid 12345 --type llm

# Summary statistics
agentsight audit --summary

# Discover running AI Agents
agentsight discover

# List known Agent types
agentsight discover --list-known

Query and manage AI Agent session interruption events.

Interruption types:

# List interruption events (default: last 24h)
agentsight interruption list [--last <HOURS>] [--type <TYPE>] [--severity <LEVEL>]

# Statistics by type
agentsight interruption stats

# Count by severity
agentsight interruption count

# Get a single event by ID
agentsight interruption get <ID>

# List all interruption events of a session / conversation
agentsight interruption session <SESSION_ID>
agentsight interruption conversation <CONVERSATION_ID>

# Mark as resolved
agentsight interruption resolve <ID>

Configuration file: /etc/agentsight/config.json (override with --config).

Important: User config files replace (not extend) the built-in default rules. Ensure your config includes all Agent rules you need.

AgentSight provides a built-in conversational skill for Copilot Shell. Users can query Token usage and audit logs via natural language:

• "How much Token did I use today?"
• "Show me today's LLM call records"

AgentSight integrates with the Tokenless component to display Token savings data in the Dashboard. No additional configuration needed — if both are installed, savings data appears automatically.

Default maximum database size: 200 MB. When reached, automatic cleanup triggers.

Customize via environment variable:

export AGENTSIGHT_GENAI_DB_MAX_SIZE_MB=500

rm -rf /var/log/sysak/.agentsight
# Then restart AgentSight

Q: Why can't I see Token data for OpenClaw?

A: AgentSight monitors the openclaw-gateway daemon. Check client-gateway connectivity. If you see "pairing required" errors, run openclaw devices approve.

Q: Why does the Token savings page show 0?

A: Possible causes: (1) The AK/SK authentication mode is not yet supported; (2) Session ID format is non-standard UUID.

Q: Why do cumulative savings exceed the single-call difference?

A: Agents include historical messages in context. Savings accumulate across turns, so cumulative savings exceed per-turn differences.