AI agent monitoring and observability

Discover every agent and harness across endpoints, servers, and containers. Stream every action into your observability stack, attributed to the agent and session behind it.

See the product

Every harness, every action, every dollar spent

See what agents are running, what they can reach, what actions were taken, where the gaps are, and what it costs.

Inventory

What agents are running?

See every agent on every laptop and server: which version it is, who uses it, and what models it calls. New installs show up the moment they appear.

An overview of all the agents, models, MCP servers, and tools in your company, and what they cost

1 / 4
Surface

What tools are the agents calling?

See which tools and MCP servers your agents actually call, and how that compares with what they are configured to use.

Every MCP server your agents use, whether it is set up, actually used, or both, and how often it is called

1 / 4
Sessions

What did the agents do?

Follow any agent session from the first prompt to the last action: every tool call, model request, file, and network connection.

Every agent session, who ran it, and what it cost

1 / 4
Coverage

Where are the gaps?

Find the agents on every machine that have not been approved, and see which team and person each one belongs to.

Agents that are installed but not monitored, grouped by team

1 / 4
Usage

What is this costing us?

Track tokens and spend for every agent, broken down by team, model, and person, and check it against the limits and targets you have set.

Total spend, how you're tracking against your budget, and how much each agent and person spends

1 / 4
How monitoring works

From install to insight in seconds

One binary finds every agent, records every action, and ships the record to the tools you already run.

1. Discover

Find every agent and harness in the fleet

  • Live inventory of every agent on the machine
  • Any runtime, framework, or harness
  • No wrappers, no SDKs, no configuration
Runs on: Mac, Windows, Linux, servers, Docker, Kubernetes

2. Observe

Record every agent action as it happens

  • Every file read, write, and permission change
  • Every tool call, MCP route, and outbound request
  • Every process, sub-agent, and LLM call
Attributed to: agent, session, and user behind each action

3. Export

Ship the record to your observability stack

  • Events normalized into a single stream
  • Usage and cost by team, provider, and agent
  • Your dashboards and alerting, now agent-aware
Sends to: SIEM, SOC, and other observability tooling
What you can see

Questions you can finally answer

From how many agents are running to why the model bill doubled, all from the same event stream.

Agent inventory

Every agent, host, user, and version. New agents appear the moment they start.

IT OpsSecurity

Shadow agent discovery

Agents are found by behavior, not a list of known binaries. Unknown agents surface in seconds.

IT OpsSecurity

MCP server and tool inventory

Every MCP server and the tools it exposes, by user, host, and agent.

SecurityPlatform

Session audit trail

The ordered sequence of reads, tool calls, spawns, and requests behind any session.

SecurityIncident Response

File access tracking

Every file an agent touches, with reads of sensitive paths tagged automatically.

SecurityData Protection

Outbound connection tracking

Every request with the agent and action that triggered it. LLM calls are parsed by provider and model.

SecurityNetwork

Sub-agent and process lineage

Every process traced back through the chain to the agent and prompt that started it.

SecurityIncident Response

Token usage and spend

Token usage rolled up by team, provider, model, and agent.

EngineeringFinance

Export to SIEM and observability

Structured events ship to Splunk, Datadog, Elastic, and your existing pipelines.

SecOpsPlatform
A session, reconstructed

Forty seconds, six events, one answer

An engineer reports a deploy script was modified unexpectedly. Incident response searches for writes to that file and lands on a session.

The trace shows the agent read a README with embedded instructions, called a shell tool, and rewrote the script — all within forty seconds.

Nobody asked the developer; nobody needed the agent's own logs.

session 7f3a9c · dev-14.localFILE WRITE · deploy.sh
00:00
session startclaude-code · pid 4821 · alice@dev-14
00:03
file read./README.md
00:04
tool callrun_shell
00:31
process spawnsh -c "sed -i … deploy.sh"
00:38
file write./scripts/deploy.sh
00:40
requestapi.anthropic.com · 2.1k tokens
The platform

AI agent runtime security, end to end

The same binary that records what agents do also sets the rules for how they're used and enforces them at the source. Monitor, govern, and secure work together as a single dynamic sandbox, with one install and one event stream.

Get Started

Seconds, not sprints

Qpoint deploys as a single binary directly on the endpoint. No gateways to route through, no enterprise infrastructure to provision, no SDK integration to schedule.

Install, run, and start seeing every AI agent on the machine — in under a minute.

$ curl -fsSL qpoint.io/install | sh