AI agent monitoring and observability

Discover every agent and harness across endpoints, servers, and containers. Stream every action into your observability stack, attributed to the agent and session behind it.

Qpoint Monitor dashboard
How monitoring works

From install to insight in seconds

One binary finds every agent, records every action, and ships the record to the tools you already run.

1. Discover

Find every agent and harness in the fleet

  • Live inventory of every agent on the machine
  • Any runtime, framework, or harness
  • No wrappers, no SDKs, no configuration
Runs on: Mac, Windows, Linux, servers, Docker, Kubernetes

2. Observe

Record every agent action as it happens

  • Every file read, write, and permission change
  • Every tool call, MCP route, and outbound request
  • Every process, sub-agent, and LLM call
Attributed to: agent, session, and user behind each action

3. Export

Ship the record to your observability stack

  • Events normalized into a single stream
  • Usage and cost by team, provider, and agent
  • Your dashboards and alerting, now agent-aware
Sends to: SIEM, SOC, and other observability tooling
What you can see

Questions you can finally answer

From how many agents are running to why the model bill doubled, all from the same event stream.

Agent inventory

Every agent, host, user, and version. New agents appear the moment they start.

IT OpsSecurity

Shadow agent discovery

Agents are found by behavior, not a list of known binaries. Unknown agents surface in seconds.

IT OpsSecurity

MCP server and tool inventory

Every MCP server and the tools it exposes, by user, host, and agent.

SecurityPlatform

Session audit trail

The ordered sequence of reads, tool calls, spawns, and requests behind any session.

SecurityIncident Response

File access tracking

Every file an agent touches, with reads of sensitive paths tagged automatically.

SecurityData Protection

Outbound connection tracking

Every request with the agent and action that triggered it. LLM calls are parsed by provider and model.

SecurityNetwork

Sub-agent and process lineage

Every process traced back through the chain to the agent and prompt that started it.

SecurityIncident Response

Token usage and spend

Token usage rolled up by team, provider, model, and agent.

EngineeringFinance

Export to SIEM and observability

Structured events ship to Splunk, Datadog, Elastic, and your existing pipelines.

SecOpsPlatform
A session, reconstructed

Forty seconds, six events, one answer

An engineer reports a deploy script was modified unexpectedly. Incident response searches for writes to that file and lands on a session.

The trace shows the agent read a README with embedded instructions, called a shell tool, and rewrote the script — all within forty seconds.

Nobody asked the developer; nobody needed the agent's own logs.

session 7f3a9c · dev-14.localFILE WRITE · deploy.sh
00:00
session startclaude-code · pid 4821 · alice@dev-14
00:03
file read./README.md
00:04
tool callrun_shell
00:31
process spawnsh -c "sed -i … deploy.sh"
00:38
file write./scripts/deploy.sh
00:40
requestapi.anthropic.com · 2.1k tokens
The platform

AI agent operations, end to end

The same binary that records what agents do also sets the rules for how they're used and enforces them at the source. Monitor, govern, and secure share one install and one event stream.

Get Started

Seconds, not sprints

Qpoint deploys as a single binary directly on the endpoint. No gateways to route through, no enterprise infrastructure to provision, no SDK integration to schedule.

Install, run, and start seeing every AI agent on the machine — in under a minute.

$ curl -fsSL qpoint.io/install | sh