Abyss: Non-invasive observability platform for AI Agent

Overview

Abyss is an open-source observability platform for AI agents. It observes agent-to-provider network traffic through a local proxy, helping developers and teams understand conversations, tool activity, token usage, and network failures without modifying agent source code or adding instrumentation to agent applications.

Built in Rust, Abyss provides:

• Explicit HTTP/HTTPS proxying and transparent proxying through macOS Network Extension and Windows WFP adapters.
• Policy-controlled TLS interception and content capture for supported agent protocols.
• Normalized events for model API protocols, including OpenAI's Responses API and Chat Completions API, and Anthropic's Messages API.
• Plugins and Rust, TypeScript, and Python SDKs for custom integrations and event delivery.

Install

Install the prebuilt CLI on Linux x86_64 (with systemd) or macOS ARM64:

curl --proto '=https' --tlsv1.2 -fsSL \
  https://github.com/lexmount/abyss-rs/releases/latest/download/install.sh | sh

Quick Start

With Node.js 22+ and npm 10+ installed, start the local environment and run an installed agent through Abyss:

abyss deploy-local start
abyss run -- codex

Open the Abyss dashboard to explore sessions, model activity, and token usage:

abyss dashboard

Dashboard preview with sample data.

See the Abyss CLI guide for configuration, capture controls, and lifecycle commands.

Supported Harnesses and Models

Harnesses	Desktop	CLI	Web
ChatGPT	✅	✅	❌
Claude	✅	✅	❌
OpenCode	✅	✅	✅
DeepSeek Harness	✅	✅	✅

Models	Supported
GPT / o-series	✅
Claude	✅
DeepSeek	✅
GLM	✅
Kimi	✅
Qwen	✅
MiniMax	✅

Broker

abyss-broker is Abyss's standalone endpoint runtime. It accepts explicit proxy connections or flows from external platform adapters, applies TLS and capture policies, parses supported agent traffic, and publishes normalized events. Its local REST API exposes runtime configuration, status, and diagnostics for CLI and application integrations.

See the broker setup guide to install, configure, and start it independently.

Plugin

Broker plugins are separate processes that subscribe to normalized AgentEvent messages over a local Unix socket or Windows Named Pipe. Use them to build custom exporters, audit integrations, and automation. The official abyss-delivery-plugin uploads events to a configured HTTP endpoint and can persist failed uploads for later replay.

The broker provides a live event stream; plugins own remote authentication, persistence, and retries. See the plugin mechanism for the integration model and protocol details.

Data query CLI

abyss-query reads sessions, events, trajectories, search results and usage from SaaS or self-hosted HTTP backends on Windows, Linux and macOS. It provides named profiles, optional bearer or terminal login, bounded pagination and versioned JSON/JSONL output for Agents. See the query CLI guide and Rust data client.

SDK

The SDKs provide clients for the broker REST API and plugin event stream, making it easier to manage local policies, inspect diagnostics, and consume typed events. Choose the reference for your integration language:

• Rust SDK
• TypeScript / Node.js SDK
• Python SDK

Architecture

---
config:
  layout: dagre
  flowchart:
    curve: basis
---
flowchart LR
    Agent[AI agents, IDEs, CLIs, and SDKs]
    Provider[AI providers]
    EventAPI[Agent event API]

    subgraph Endpoint[Abyss endpoint runtime]
        CLI[abyss CLI]
        Ingress[abyss-broker ingress]
        MITM[abyss-mitm<br/>TLS and HTTP relay]
        Hook[abyss-agent-hook<br/>protocol parsing]
        Protocol[abyss-plugin-protocol<br/>normalized AgentEvent]
        Delivery[abyss-delivery-plugin]
        State[(Policy, CA, diagnostics,<br/>and durable local state)]

        CLI -->|lifecycle, auth, and policy| Ingress
        CLI -->|delivery credentials| Delivery
        Ingress <--> MITM
        MITM --> Hook
        Hook --> Protocol
        Protocol --> Delivery
        Ingress <--> State
        MITM <--> State
        Delivery <--> State
    end

    Agent <-->|HTTP, HTTPS, and WebSocket| Ingress
    MITM <-->|upstream traffic| Provider
    Delivery -->|authenticated event upload| EventAPI

Loading