AgentWire: A Wireshark for AI Agents

Black-box execution is the biggest liability in the agentic stack. When a request hits an LLM or an MCP server, you usually only see the final output, leaving you blind to how many tokens were actually burned, which specific hop caused a latency spike, or if a prompt injection quietly slipped through the chain.

AgentWire attempts to fix this by treating agent traffic like network packets. It's essentially an observability and security layer designed to track the "packet trail" of an AI workflow.

The Technical Trade-off

Unlike basic logging wrappers, this is built on ASP.NET Core as an event-driven system. The goal is to ingest high-throughput streams without blocking the agent's execution. It aims to merge three distinct functions:

• Observability: Tracing the path between user, agent, and MCP servers.
• Security: Scanning for secret leaks and prompt injections.
• Cost Intelligence: Attributing exact dollar amounts to specific agents or models.

Looking at the current state, it's a lean MVP. It relies on SQLite for now, with ClickHouse planned for when the data scales. While the vision is "OpenTelemetry + Wireshark," the current reality is a set of basic ingestion and analytics endpoints.

Deployment: A Practical Tutorial

If you want to test the ingestion pipeline, you'll need the .NET 10 SDK.

1. Spin up the API

git clone https://github.com/qmmughal/AgentWire.git
cd AgentWire
dotnet run --project src/AgentWire.Presentation

2. Push a trace packet
The system uses a POST /v1/traces endpoint. You send the prompt, response, and token counts, and it handles the cost calculation in the background.

curl -X POST http://localhost:5102/v1/traces \
 -H "Content-Type: application/json" \
 -d '{
 "traceId": "demo-001",
 "agentId": "support-bot",
 "modelProvider": "openai",
 "modelName": "gpt-4o-mini",
 "systemPrompt": "You are a helpful assistant.",
 "userPrompt": "Hello",
 "llmResponse": "Hi there!",
 "promptTokens": 12,
 "completionTokens": 8,
 "latencyMs": 220
 }'

3. Verify the data
You can pull the enriched packet (including the calculated cost) via the packets endpoint:

curl http://localhost:5102/v1/packets

The output returns the traceId and the exact cost associated with that specific LLM call:

[
 {
 "traceId": "demo-001",
 "packetId": "pk_9f2c1a",
 "agentId": "support-bot",
 "modelProvider": "openai",
 "modelName": "gpt-4o-mini",
 "promptTokens": 12,
 "completionTokens": 8,
 "latencyMs": 220,
 "cost": 0.0000042,
 "timestamp": "2026-07-26T10:15:03Z"
 }
]

It's a promising start for anyone needing a deep dive into their AI workflow, though the real test will be how it handles massive concurrency once the YARP-based gateway is implemented.