Logira – eBPF runtime auditing for AI agent runs
I started using Claude Code (claude --dangerously-skip-permissions) and Codex (codex --yolo) and realized I had no reliable way to know what they actually did. The agent's own output tells you a story, but it's the agent's story. logira records exec, file, and network events at the OS level via eBPF, scoped per run. Events are saved locally in JSONL and SQLite. It ships with default detection rules for credential access, persistence changes, suspicious exec patterns, and more. Observe-only – it never blocks. https://github.com/melonattacker/logira
Logira – eBPF runtime auditing for AI agent runs launched on March 1, 2026 with 26 votes, #808 of 23,380 launches that month and more than 95% of that year's launches.
In plain words
Logira is an eBPF-based auditing tool that monitors what AI agents actually do at the operating system level. It records execution, file, and network events during agent runs and stores them locally in JSONL and SQLite formats. The tool includes built-in detection rules for credential access, persistence changes, and suspicious execution patterns. It runs in observe-only mode and is designed for developers using AI coding agents who need visibility into actual system behavior beyond what agents report themselves.
written from the facts on this page · September 2026
From the sources
OS-level runtime auditing for unpredictable automation. - melonattacker/logira
logira is an observe-only Linux CLI that records runtime exec , file , and net events via eBPF. It helps you see what actually happened during AI agent runs and other forms of automation, with per-run local storage for auditing, post-run review, search, and detection triage. logira includes an opinionated, observe-only default ruleset aimed at auditing AI agent runs. You can also append your own per-run rules YAML with logira run --rules <file> . curl -fsSL https://raw.githubusercontent.com/melonattacker/logira/main/install.sh | sudo bash Option2. Manual install from a release tarball: tar -xzf logira_vX.Y.Z_linux- < arch > .tar.gz cd logira_vX.Y.Z_linux- < arch > sudo ./install-local.sh…from github.com
Does a similar job
all alternatives →
Progress AI ObservabilityAug 2026 · telerik.com · ▲168Hi HN! We’re the team behind Fiddler, and we recently built an Agent Cache feature. It works by capturing an LLM request/response pair and, once caching is enabled, serving subsequent matching calls locally so duplicate requests never hit the provider. It’s meant to reduce three pains that show up together in agent development: token cost, feedback-loop latency, and output non-determinism. We’d love to hear your thoughts.
Agent-of-empires: OpenCode and Claude Code session managerJan 2026 · github.com · ▲118Hi! I’m Nathan: an ML Engineer at Mozilla.ai: I built agent-of-empires (aoe): a CLI application to help you manage all of your running Claude Code/Opencode sessions and know when they are waiting for you. - Written in rust and relies on tmux for security and reliability - Monitors state of cli sessions to tell you when an agent is running vs idle vs waiting for your input - Manage sessions by naming them, grouping them, configuring profiles for various settings I'm passionate about getting self-hosted open-weight LLMs to be valid options to compete with proprietary closed models. One…
Real-time dashboard for Claude Code agent teamsApr 2026 · github.com · ▲77This project (Agents Observe) started as an exploration into building automation harnesses around claude code. I needed a way to see exactly what teams of agents were doing in realtime and to filter and search their output. A few interesting learnings from building and using this: - Claude code hooks are blocking - performance degrades rapidly if you have a lot of plugins that use hooks - Hooks provide a lot more useful info than OTEL data - Claude's jsonl files provide the full picture - Lifecycle management of MCP processes started by plugins is a bit kludgy at best The biggest takeaway is…
Goroutine Monitor Powered by eBPF2024 · github.com · ▲75An eBPF tool monitoring a goroutine. Contribute to keisku/gmon development by creating an account on GitHub.
AgentSight – eBPF observability for AI agents, no code changesAug 2026 · github.com · ▲17- IAI am running 3 coding agents non-stop over the last 3 days. Here is howJun 2026 · ▲10
1. Headless mode Headless mode allows you to use the AI as a command-line utility for automation and scripting. In Claude Code you run it with the -p flag: claude -p, in codex - exec, opencode - run. 2. Ask human The traditional communication channel with the operator won't work in headless mode - we need to implement a dedicated tool. Here is an example of how this can be done https://github.com/sermakarevich/claude/tree/main/mcp/ask_hu... 3. Tasks queue Beads is a lightweight distributed graph issue tracker for AI agents, powered by Dolt. You can…
More ai this month
the category →
Paintings by AI models: programs run through a simulation of oil paint.
AI · 20d ago · stillwet.art
PixVerse R2▲381A real-time world model you can explore and change
AI · 28d ago · world.pixverse.video
Source: Show HN post ↗
Launched alongside, March 2026
the whole month →
Switch from ChatGPT to Claude with import memory feature
AI · Mar 2026 · claude.com
Littlebird▲709Littlebird remembers everything across your meetings, messages, docs, and apps, then takes action so you can recall any detail and never lose context.
AI · Mar 2026 · littlebird.ai
