AgentSight is a Linux-based observability tool that monitors AI agent token usage and behavior without requiring code changes.
It uses kernel-level eBPF capture to track LLM API calls, token consumption by agent and model, and interruption events like crashes or context overflow.
A web dashboard displays real-time metrics and session traces on port 7396, with token-based authentication for remote access.
What happened
AgentSight is a zero-instrumentation observability tool for AI agents running on Linux that captures token consumption, LLM API calls, and process behavior at the kernel level using eBPF (extended Berkeley Packet Filter), a Linux kernel feature. It requires Linux kernel >= 5.8 with BTF support, root or CAP_BPF privileges, and is installed via the ANOLISA CLI or YUM. The tool runs as a systemd service and serves a web dashboard on port 7396.
Why it matters
Teams running AI agents can monitor token usage across agents, tasks, and models; detect LLM errors, context overflow, SSE truncation, and agent crashes; and audit every LLM call—all without modifying agent code. The dashboard provides real-time token trends, agent health status, and session traces. Integration with Copilot Shell's conversational skill lets users query token usage and audit logs via natural language, and optional Tokenless integration displays token savings data.
What to watch
The tool stores data in SQLite (default 200 MB max capacity; customizable via AGENTSIGHT_GENAI_DB_MAX_SIZE_MB) and auto-triggers cleanup when the limit is reached. Dashboard authentication is token-based for remote access (64 hex characters, auto-generated and persisted); localhost access (127.0.0.1:7396) is authentication-free. macOS support is limited to two commands—trace (scans local JSONL session files) and serve (dashboard viewer)—with all eBPF-dependent features Linux-only.
Ask the AI about this article →
AgentSight fills a gap in AI agent observability by operating at the kernel level without requiring instrumentation inside agent code. The tool uses eBPF, a Linux kernel technology that allows safe execution of programs in kernel space, to intercept system calls and network traffic at the lowest level. This approach avoids the performance cost and code maintenance burden of traditional application-level logging.
The observability focus is three-fold: token economics (usage tracking by agent, task, and model), behavioral auditing (complete LLM call tracing), and reliability monitoring (detection of errors, crashes, and context overflows). The built-in dashboard serves real-time visualization, while CLI commands support programmatic queries and integration with downstream systems. The optional integration with Tokenless component enables teams to see token savings data alongside raw consumption metrics, addressing the growing need to optimize LLM spending across multi-turn agent sessions.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
Analyst Ming-Chi Kuo says Nvidia has revived the Rubin CPX AI accelerator with a substantially redesigned arch…
A UK study by UK AI Security Institute and Limbic AI surveyed 6,474 British adults
Broadcom's Clayton Donley says companies are doing mission-critical work with AI agents quickly, but without t…
OpenAI released a new evaluation framework on July 17, 2026, urging companies to measure AI ROI by 'useful out…
As AI agents perform real business tasks, 'Agentic Identity' (giving each AI a unique employee-like ID) and 'D…
The European Union is expanding regulation of ChatGPT and will mandate protections for minors
