Runtime observability
2026
AgentScope
See what an agent actually does.
About the project
I built AgentScope to show what an agent executes, which files it opens, and where it connects, with policy alerts alongside the activity.
Look beyond what the agent reports
An autonomous coding agent can install packages, read credentials, and contact remote hosts. Its own logs only show what it reports. I use Linux kernel tracepoints to observe process execution, file opens, and outbound connections, giving AgentScope a source of evidence outside those application logs.
Give the events enough context
The eBPF probes send bounded records through a ring buffer to a Rust collector. I connect those records to a declarative policy engine that flags selected processes, secret paths, and network destinations. The dashboard combines a process tree, network map, file-access timeline, violations feed, and live policy editor. REST and Server-Sent Events expose the same data.
Make a run repeatable
I added a deterministic event simulator and replay command so collection, policy evaluation, and the dashboard can be exercised without a Linux kernel. Windows and macOS use that simulated path. Replaying the same events also provides a repeatable check when a detection rule changes.
Observation before enforcement
I kept this release focused on observation and alerts. It detects and reports activity but does not block syscalls. Real collection requires Linux; other platforms use simulated events. History lives in memory, and the API has no built-in authentication, so it belongs on localhost or a trusted management network. Persistent storage, stronger attribution, and enforcement remain further work.
Next project
