Use AgentSight when an operator needs to understand what an existing agent CLI actually did on a Linux machine without adding SDK instrumentation or routing traffic through a proxy. The workflow is to install the binary, run live top mode or record a specific command such as Claude Code, Codex, Gemini CLI, OpenCode, OpenClaw, or any local agent process, then inspect saved SQLite-backed reports for subprocesses, file writes, network destinations, prompts, responses, tokens, and audit events. This is useful for auditing risky automation, debugging unexpected tool behavior, reviewing agent side effects, or comparing what a CLI reported with what happened at the operating-system boundary. Invoke this instead of normal application observability when the agent is closed-source, shell-heavy, or crossing process and filesystem boundaries that framework traces miss. The boundary is system-level agent session recording and audit reporting with eBPF/TLS tracing; it is not a generic observability dashboard or an SDK integration.