Alibaba released an operating layer for agents — and it honestly reports every token spent

In my practice, the same scenario repeats regularly: an agent on Claude Code runs tool after tool, and massive JSON documents fly into the context. Half the fields there are empty tags, metadata: null, debug garbage. The model reads all of it, and we pay for it. Familiar pain?

The Alibaba team decided to tackle the problem systematically and open-sourced ANOLISA — a server-side overlay for AI agent workloads. The name stands for Agentic Nexus Operating Layer & Interface System Architecture, but the gist is simpler: it's a set of tools that doesn't replace your shell, framework, or sandbox, but sits between the agent and the system. Written in Rust, distributed under Apache 2.0, runs on Linux and macOS.

What's actually in the box

The project consists of a dozen components, but they group into three areas.

First — the agent entry point. Here the main role belongs to cosh-ng: a terminal that preserves familiar Bash/Zsh behavior but adds an agent that understands natural language commands. Dangerous operations are confirmed before execution. No need to open a separate chat with a bot — everything happens in the same terminal window. There's also ktuner for kernel tuning and a set of OS Skills with DevOps expertise.

Second and, in my view, the most interesting — context savings. Three tools: Token-less compresses tool responses and their schemas before they reach the model, Agent Memory reuses useful context across sessions, and AgentSight shows where tokens actually go.

Third — runtime and security: Agent Sec Core isolates risky operations, ws-ckpt stores rollback points for workspace changes, Blaze manages sandbox lifecycles, and SkillFS keeps focus on the current Skill.

Token-less: compression without touching agent code

Let me start with the most tangible feature. Token-less sits between the agent and the model and cleans up excess from tool schemas and responses: fields like debug and trace go into a blacklist, metadata with a null value gets dropped, empty arrays collapse. Compression is reversible — discarded array elements remain accessible via the <<tokenless:KEY>> marker, meaning the agent can retrieve them back if needed.

Architecturally, this is elegant: compression happens between the agent and the model, so you don't need to change the agent framework. Plug in the adapter — and you're off. Numbers from the README:

| What gets optimized | Token savings | Latency | |--------------------|------------------|----------| | Tool responses | 65.8% | 46.85 μs | | Tool schemas | 47.3% | 11.44 μs | | Full pipeline | 62.9% | 198.91 μs |

Latencies in the tens of microseconds you simply won't notice. In one observed task run with Claude Code, the system saved 317K tokens, or 40.5% — though the authors themselves honestly note that the result depends on the workload.

Setup takes minutes:

curl -fsSL https://get.agentic-os.sh | bash
export PATH="$HOME/.local/bin:$PATH"
anolisa install tokenless
anolisa adapter enable tokenless claude-code

After restarting Claude Code, you can run a tool-heavy task and check the stats:

tokenless stats summary
tokenless stats list --limit 5

One nuance worth knowing upfront: savings apply to tool responses that end up in context, not to the entire session bill. On tasks where the agent barely calls tools, there won't be any gains.

AgentSight: an agent under the microscope

The second find — AgentSight. On Linux, it observes the agent via eBPF, without touching its code at all. You see the path from user input through model and tool calls, including token usage and sub-agent branches, in a single view. Here's an agent observation from the kernel level:

For debugging agent pipelines, this looks like a convenient alternative to custom-written loggers: eBPF catches everything systemically, rather than only where you remembered to put a trace.

Security: the boundary and the way back

Two things in the runtime block stood out separately.

Agent Sec Core can detect signed Skill substitution. If a signed Skill has changed, the agent will mark it as drifted and won't use it until rescanned; blocking findings after a rescan are recorded with status deny. For those connecting third-party Skill sets to agents, this is protection against classic injection attacks.

ws-ckpt stores recovery points for workspace changes. The agent dug around in files and broke everything? You roll back. Like git for agent experiments on the filesystem.

Who this is for

If you think about it simply:

• Teams whose agents run heavy tool chains and eat up token budgets — start with Token-less, it installs in three minutes and doesn't require rewriting anything.
• Those who work in the terminal and want an agent right there, not in a separate chat window — cosh-ng.
• Engineers who need to understand exactly what the agent is doing to the system — AgentSight plus ws-ckpt gives you both observability and a safety net.

So is it worth trying

The project is young: as of this writing, the repository has about 610 stars, quite a few open issues (161), and the community currently lives mainly in DingTalk, which isn't the most convenient channel for English-speaking developers. The documentation on the agentic-os.sh website is fairly comprehensive, with a Quick Start covering specific first-run scenarios.

I'd start with Token-less: minimal risk, tangible savings, simple installation, and easy rollback if it doesn't work out. Cosh-ng requires a system-wide installation — that's a more serious commitment, but for those who live in the terminal, the idea of a shell merged with an agent makes sense.

Apache 2.0 license, Rust codebase, Alibaba behind it. Install it, run tokenless stats on your own tasks, and watch the numbers — they'll tell you better than any review.