AgentWire: A Wireshark for AI Agents

AgentWire, an open-source observability and security layer for AI agent workflows, has been released as a minimal viable product (MVP) built on ASP.NET Core. The tool treats agent traffic like network packets, enabling tracing of prompts, responses, token usage, latency, and cost attribution per agent or model. Currently relying on SQLite with plans for ClickHouse, AgentWire provides a REST API for ingestion and analytics, aiming to merge observability, security scanning for prompt injections, and cost intelligence.

AgentWire: A Wireshark for AI Agents MCP /en/tags/mcp/ server, you usually only see the final output, leaving you blind to how many tokens were actually burned, which specific hop caused a latency spike, or if a prompt injection quietly slipped through the chain. AgentWire attempts to fix this by treating agent traffic like network packets. It's essentially an observability and security layer designed to track the "packet trail" of an AI workflow. The Technical Trade-off Unlike basic logging wrappers, this is built on ASP.NET Core as an event-driven system. The goal is to ingest high-throughput streams without blocking the agent's execution. It aims to merge three distinct functions: Observability: Tracing the path between user, agent, and MCP servers. Security: Scanning for secret leaks and prompt injections. Cost Intelligence: Attributing exact dollar amounts to specific agents or models. Looking at the current state, it's a lean MVP. It relies on SQLite for now, with ClickHouse planned for when the data scales. While the vision is "OpenTelemetry + Wireshark," the current reality is a set of basic ingestion and analytics endpoints. Deployment: A Practical Tutorial If you want to test the ingestion pipeline, you'll need the .NET 10 SDK. 1. Spin up the API git clone https://github.com/qmmughal/AgentWire.git cd AgentWire dotnet run --project src/AgentWire.Presentation 2. Push a trace packet The system uses a POST /v1/traces endpoint. You send the prompt, response, and token counts, and it handles the cost calculation in the background. curl -X POST http://localhost:5102/v1/traces \ -H "Content-Type: application/json" \ -d '{ "traceId": "demo-001", "agentId": "support-bot", "modelProvider": "openai", "modelName": "gpt-4o-mini", "systemPrompt": "You are a helpful assistant.", "userPrompt": "Hello", "llmResponse": "Hi there ", "promptTokens": 12, "completionTokens": 8, "latencyMs": 220 }' 3. Verify the data You can pull the enriched packet including the calculated cost via the packets endpoint: curl http://localhost:5102/v1/packets The output returns the traceId and the exact cost associated with that specific LLM call: { "traceId": "demo-001", "packetId": "pk 9f2c1a", "agentId": "support-bot", "modelProvider": "openai", "modelName": "gpt-4o-mini", "promptTokens": 12, "completionTokens": 8, "latencyMs": 220, "cost": 0.0000042, "timestamp": "2026-07-26T10:15:03Z" } It's a promising start for anyone needing a deep dive into their AI workflow, though the real test will be how it handles massive concurrency once the YARP-based gateway is implemented. Next Open-Weight AI: The Kubernetes Moment → /en/threads/3666/