AgentSight uses eBPF to audit what AI agents really do on your machine, not what they say they do

By Zendoric · October 4, 2026.

AgentSight is an open-source tool, released under an MIT license on GitHub by the eunomia-bpf project, that monitors AI agents —Claude Code, Gemini CLI, Kimi Code, Grok Build and others— from outside the model itself. Instead of relying on the logs the agent itself chooses to write, it uses eBPF (extended Berkeley Packet Filter), a Linux kernel technology that makes it possible to observe processes, files and network traffic in real time without modifying the operating system or the code of the application being monitored. According to the project's own evaluation, the CPU overhead it introduces is under 3% on typical workloads.

The most striking technical element is how it handles the capture of encrypted traffic. Agents talk to models over HTTPS, protected by TLS (Transport Layer Security, the protocol that encrypts communications on the internet). AgentSight intercepts those calls directly in the process's SSL library, before the content is encrypted, so it can read prompts and responses in the clear without needing a proxy or integrating an SDK (software development kit) into the agent's application. That, as the project itself notes in comparison, is the difference with tools such as LangSmith, Langfuse, Phoenix or Helicone, which require instrumenting the code or routing traffic through a managed service; AgentSight, by contrast, hooks into existing binaries, including closed-source ones.

The project documents its limitations honestly. It cannot track agents inside the Cursor IDE (integrated development environment) via eBPF, because it is an Electron application whose traffic travels encrypted inside a packaged binary and uses protobuf instead of JSON for its API traffic; there it falls back on reading the agent's own native session files. And for CLIs (command-line interfaces) such as Claude Code or Node.js, which statically link their own SSL library —BoringSSL or OpenSSL— inside the binary, it needs an automatic executable-discovery step in order to hook in.

The tool is organized into several commands: 'top' shows live sessions by model, tokens and activity; 'record' captures a full run and requires administrator privileges to enable eBPF; 'report' queries sessions stored in a SQLite database; and 'vis' generates an animated replay of a development session over a repository, showing which files the agent read, wrote or deleted. It also exports events in the standard OpenTelemetry GenAI format, designed to plug into the monitoring systems many companies already use. On GitHub it has accumulated 719 stars and 108 forks; its Hacker News post, however, barely gathered two points and no comments, a sign that for now it is a niche tool within a niche.

The problem it tackles is not new, but it has become urgent as agents stop being a chat and start executing commands, writing files and calling external services on their own. At Zendoric we have already noted that the operational risk of agentic AI today lies less in model misalignment than in the fact that, once deployed, almost nobody knows precisely which systems an agent can touch or what it has actually touched. AgentSight does not solve that governance problem, but it supplies the missing piece for attempting to: an independent, kernel-level record that cannot be disabled or tampered with by the very agent it is watching.

Our reading is that this kind of observability infrastructure is going to become a requirement, not an extra, as companies delegate more real permissions to agents. In the short term, the cost of adopting agentic AI in production is not just the cost of tokens: it is the cost of building —or buying— the audit layer that makes it possible to trust an autonomous process with access to files, credentials and networks. It is unglamorous work, pure systems engineering, which is why projects like this rarely generate headlines. But it is exactly the kind of guardrail this transition needs: the more visibility we have into what an agent actually does, the more high-risk tasks —from operating infrastructure to assisting in scientific research— we will be able to delegate to it with confidence, which is, in the end, part of the road toward the abundance we defend over the long term: you do not get there by turning agents loose without oversight, but by learning to see them with the same clarity with which we see any other process on our system.