What makes AgentSight different technically?
It uses eBPF boundary tracing to observe LLM calls, file and network activity and tool calls, rather than relying on hooks inside the agent. It was published with an arXiv paper in August 2025.
Beam vs EUNOMIA-BPF
Beam vs AgentSight
AgentSight takes a different technical route to the same question: it uses eBPF boundary tracing to watch LLM calls, files, network and tool calls, and pairs with a companion enforcement component called ActPlane. It is free, open source and research-led. Beam works from agent hooks and normalised records instead, and adds pre-run skill and MCP scanning.
Beam vs AgentSight, side by side
Details below are drawn from a September 2026 review of the AI agent security market. Some figures are vendor-sourced or analyst estimates, and this is a fast-moving space — check with each vendor before you buy. Composio details come from its own pricing and documentation pages as of October 2026.
| Beam | AgentSight (eunomia-bpf) | |
|---|---|---|
| What it is | Local-first activity monitor, policy enforcement, and pre-run scanner for AI coding agents, with a Sentinel browser extension for AI chats. | Open-source research tool that traces agent behaviour at the kernel boundary with eBPF. |
| Monitoring | Shell commands, file changes, tool calls, network endpoints and browser actions from harnesses such as Claude Code, Codex and Cursor, plus Beam Sentinel checks on supported AI chat sites before send. Normalised into local NDJSON with risk flags and evidence attached. | eBPF boundary tracing of LLM calls, file and network activity and tool calls, with prompt-injection detection. |
| Skill / MCP scanning | Yes. SKILL.md files and MCP configurations are scanned before you run them, using 11 heuristic patterns plus an MCP version-pin check. Workspace admins can also block an MCP server for the org or one user. | Not covered in our source research. |
| Blocking / enforcement | Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse hooks. The Sentinel Chrome extension pauses or blocks high-risk browser sends and can hold a send after redacting live secrets. | A companion component, ActPlane, handles the enforcement side. |
| Individual use | Free for up to 3 people, and Pro for one person at $8/month. Team workspaces add owner/admin roles, org baselines, stricter member overrides and a control plane. | Free for anyone; aimed at researchers and developers. |
| Deployment | Local collector plus a workspace dashboard. Apple and Windows MDM. Sentinel Chrome extension for browser AI chats. Licensed self-hosted control plane for teams that need it on their own infrastructure. | Self-hosted, open source. |
| Source / licence | AGPL-3.0 for the local CLI and collector; the multi-user control plane is proprietary. | Open source; published with an arXiv paper in August 2025. |
| Pricing | Free for up to 3 people. Pro $8/month for one person. Team $20 per developer and $5 per browser seat a month, billed yearly. | Free. |
AgentSight in numbers
As reported in our source research. Some figures are estimates.
- Published
- arXiv paper, August 2025
- Approach
- eBPF boundary tracing
- Audience
- Researchers and developers
Where AgentSight does more
- eBPF boundary tracing sees activity at the kernel boundary rather than relying on the agent's own hooks.
- Free and open source, with a published paper behind the approach.
- Prompt-injection detection is part of the tracing design, and ActPlane covers enforcement.
Where Beam differs
- Beam is a product rather than a research artifact: a collector, a timeline and scan reports you can read without building anything.
- Beam adds pre-run scanning of skill files and MCP configurations as a separate step.
- Beam normalises records from several harnesses into one local NDJSON stream with credentials redacted.
Beam’s current gaps
- Enforce is hook-based: a native deny is wired for Claude Code and Codex PreToolUse. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block.
- Missing, unreadable or expired cached policy allows the action. Beam is not a fail-closed kernel sandbox or an in-silicon watchdog.
- Scanning is heuristic pattern matching. It produces false positives, misses novel phrasing, and is not a guarantee of safety.
- There is no SOC 2 report and no default SIEM forwarder. Kernel isolation like OpenShell remains a different layer.
Which one fits
If kernel-level visibility matters to you and you are comfortable with a research-grade open-source tool, AgentSight is the more interesting technical approach. Beam is the easier thing to read a timeline in, with workspace policy denies on Claude Code and Codex hooks rather than eBPF.
FAQ
Is AgentSight free?
Yes. It is open source and free, aimed at researchers and developers.
Does AgentSight enforce policy?
Enforcement is handled by a companion component called ActPlane, at the eBPF boundary. Beam enforces workspace policy through Claude Code and Codex PreToolUse hooks and the Sentinel browser extension — not at the kernel.
See how Beam works
Beam is an early, local-first prototype. Read what it actually does today before comparing it further.