Coding Agent Observability: Claude Code, Codex, Cursor and More

Last verified on Nov 8, 2026.

Coding agents now write a real share of the code that ships, and most teams have no record of what they did. Which model ran, how many tokens it used, which commands it executed, which repository it touched. Each tool in this category can export that as OpenTelemetry, and Sazabi stores it as searchable records.

What the sources record

The shape is similar across tools. Each session produces events or spans for prompts, tool calls and model requests, with token counts, and for some tools, cost.

• Claude Code emits claude_code.user_prompt, claude_code.tool_result and claude_code.api_request, with session.id, user.email and the model. See Claude Code.
• Codex emits codex.user_prompt, codex.tool_decision, codex.tool_result and codex.api_request. One [otel] section in ~/.codex/config.toml covers the CLI, the desktop app and the IDE extension. See Codex.
• Cursor runs the export on its own servers, so one team admin configures it once for the IDE, the cursor-agent CLI and Cloud Agents. See Cursor.
• Gemini CLI emits gemini_cli.user_prompt, gemini_cli.tool_call and gemini_cli.api_request events. See Gemini CLI.
• Devin, oh-my-pi, GitHub Copilot, OpenHands, OpenClaw, Hermes Agent and Factory Droid follow the same idea. See Devin and oh-my-pi.

Why teams collect it

Usage and cost come first. Token counts per user and model show who uses what and where spend comes from. Second is accountability for agent work. Tool results and commits show what an agent changed. Third is debugging the agent itself, since a failed tool call or a loop is much easier to see in a trace than in a terminal that scrolled away.

Cursor's cloud agent commit events carry the commit SHA as vcs.ref.head.revision and the repository as vcs.repository.url. That lets you tie an agent's work to the deploy that shipped it.

Example: tokens by model

The Copilot and oh-my-pi sources record gen_ai.request.model, gen_ai.usage.input_tokens and gen_ai.usage.output_tokens on model-call spans. The Sazabi docs suggest asking this from the CLI:

sazabi logs ask "Output tokens per gen_ai.request.model for GitHub Copilot in the last hour"

An example answer, with made-up numbers:

gen_ai.request.model     output tokens
model-large                    184,200
model-small                     61,900

Run it over a week instead of an hour and the split shows whether a team defaults to the expensive model for work the cheap one handles. For Claude Code, claude_code.api_request events carry token counts and cost per call, so you can sum by user.email.

Privacy settings come first

Every tool here can export sensitive text, and the defaults differ.

• Claude Code exports raw prompt text only when OTEL_LOG_USER_PROMPTS=1. Prompts can contain anything a developer typed or pasted.
• Devin CLI exports prompt and response text and tool arguments by default. Add "disable_user_prompt_logging": true and "disable_tool_logging": true to its otel block to keep that content out.
• GitHub Copilot does not export prompts, responses or tool arguments unless you turn content capture on.
• Codex tool_result events carry the tool's full input and output, which can include shell commands and their results.

Decide what you need, then set it deliberately. Session structure, model and token counts are usually enough for usage tracking, and they carry no code.

What to watch across tools

• Identity. The email field is named differently per tool: Claude Code and Codex use user.email and Cursor uses cursor.user.email, which it sets only when it knows the member. Agree on one identity field before you build reports.
• Org-managed settings. Factory Droid reads a pinned telemetry block that members can't redirect, and Cursor is set once by an admin. Those are the choices to make when you need full coverage.
• Metric data points. If you enable a metrics exporter, Sazabi stores each data point as a log record, which raises volume. Turn it off if the events already carry what you need.
• Retention. Prompt text is the most sensitive data you hold. Keep it only as long as you need it.

Detections and your own queries

None of the detections Sazabi runs today is tied to coding agent sources, so the usage reports, cost summaries and agent-loop checks on this page are queries you run yourself. To understand the transport, read OpenTelemetry with Sazabi.