// HACKER NEWS — CYBERSECURITY
Show HN: AgentSight – eBPF observability for AI agents, no code changes
AgentSight is a zero-instrumentation AI Agent observability tool based on eBPF. It captures LLM API calls, Token consumption, and process behavior at the kernel level without modifying Agent code.
AgentSight provides full-stack observability for AI Agents running on Linux:
macOS: On macOS, AgentSight provides two commands — trace (trajectory collector that scans local JSONL session files, no eBPF) and serve (Dashboard viewer). All other eBPF-dependent commands are Linux-only.
Install the published component with the ANOLISA CLI:
Use make build-all for source builds: it builds the Dashboard frontend, the main binary, and agentsight-enforcer in sequence. Running only make build skips the enforcer, and serve will keep logging AgentSight enforcement unavailable.
Use the systemd unit for a normal deployment. It runs eBPF tracing and the
Dashboard together and starts the enforcer dependency in the required order:
Open http://localhost:7396 after the service becomes active. Enabling the
main unit also keeps AgentSight available after a reboot.
The bundled systemd launcher binds the Dashboard to 0.0.0.0. Restrict port
7396 with a firewall or security group before exposing the host to an
untrusted network.
The service runs as root with a private umask and stores data under
/var/log/sysak/.agentsight. Use sudo for CLI queries and Dashboard access
commands that read this service-owned data.
For foreground troubleshooting, stop the systemd unit first so it does not
compete with a second tracer. Then use two terminals and run both commands as
root. The second command is not reached if both are entered sequentially
because agentsight trace stays in the foreground: