What are the minimum system requirements?

AgentSight requires Linux with kernel >= 5.8 (with BTF support), root or CAP_BPF privileges, and runs on Linux x86_64 in system mode. macOS supports only the trace and serve commands, without eBPF functionality.

How is authentication handled on the dashboard?

Localhost access (127.0.0.1:7396) is authentication-free. Remote access requires appending ?token= to the URL or setting the Authorization: Bearer HTTP header. The token is a 64 hex character string auto-generated on first startup and persisted to the .dashboard_token file; authentication can be disabled in the config file only on trusted internal networks.

What types of agent interruptions does AgentSight detect?

The tool detects five interruption types: llm_error (HTTP status >= 400 or SSE error, high severity), sse_truncated (SSE stream ended without finish_reason=stop, high), context_overflow (context length exceeded, high), agent_crash (process disappeared mid-session, critical), and token_limit (finish_reason=length with output near max, medium).

Large Language ModelsAI Coding AssistantsHacker NewsAug 21, 2026Aug 22, 2026, 01:02 JST

AgentSight: eBPF tool tracks AI agent token use without code changes

Send on LINE

3 Key Points

What happened
AgentSight is a zero-instrumentation observability tool for AI agents running on Linux that captures token consumption, LLM API calls, and process behavior at the kernel level using eBPF (extended Berkeley Packet Filter), a Linux kernel feature. It requires Linux kernel >= 5.8 with BTF support, root or CAP_BPF privileges, and is installed via the ANOLISA CLI or YUM. The tool runs as a systemd service and serves a web dashboard on port 7396.
Why it matters
Teams running AI agents can monitor token usage across agents, tasks, and models; detect LLM errors, context overflow, SSE truncation, and agent crashes; and audit every LLM call—all without modifying agent code. The dashboard provides real-time token trends, agent health status, and session traces. Integration with Copilot Shell's conversational skill lets users query token usage and audit logs via natural language, and optional Tokenless integration displays token savings data.
What to watch
The tool stores data in SQLite (default 200 MB max capacity; customizable via AGENTSIGHT_GENAI_DB_MAX_SIZE_MB) and auto-triggers cleanup when the limit is reached. Dashboard authentication is token-based for remote access (64 hex characters, auto-generated and persisted); localhost access (127.0.0.1:7396) is authentication-free. macOS support is limited to two commands—trace (scans local JSONL session files) and serve (dashboard viewer)—with all eBPF-dependent features Linux-only.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

AgentSight fills a gap in AI agent observability by operating at the kernel level without requiring instrumentation inside agent code. The tool uses eBPF, a Linux kernel technology that allows safe execution of programs in kernel space, to intercept system calls and network traffic at the lowest level. This approach avoids the performance cost and code maintenance burden of traditional application-level logging.

The observability focus is three-fold: token economics (usage tracking by agent, task, and model), behavioral auditing (complete LLM call tracing), and reliability monitoring (detection of errors, crashes, and context overflows). The built-in dashboard serves real-time visualization, while CLI commands support programmatic queries and integration with downstream systems. The optional integration with Tokenless component enables teams to see token savings data alongside raw consumption metrics, addressing the growing need to optimize LLM spending across multi-turn agent sessions.

FAQ

What are the minimum system requirements?: AgentSight requires Linux with kernel >= 5.8 (with BTF support), root or CAP_BPF privileges, and runs on Linux x86_64 in system mode. macOS supports only the trace and serve commands, without eBPF functionality.
How is authentication handled on the dashboard?: Localhost access (127.0.0.1:7396) is authentication-free. Remote access requires appending ?token=<TOKEN> to the URL or setting the Authorization: Bearer <TOKEN> HTTP header. The token is a 64 hex character string auto-generated on first startup and persisted to the .dashboard_token file; authentication can be disabled in the config file only on trusted internal networks.
What types of agent interruptions does AgentSight detect?: The tool detects five interruption types: llm_error (HTTP status >= 400 or SSE error, high severity), sse_truncated (SSE stream ended without finish_reason=stop, high), context_overflow (context length exceeded, high), agent_crash (process disappeared mid-session, critical), and token_limit (finish_reason=length with output near max, medium).

Hacker NewsRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.