eBPF MCP

- ✅ Query kernel version, architecture, and BTF availability
- ✅ Load programs from disk or inline base64 with optional BTF
- ✅ Attach to live systems with type-safe constraints
- ✅ Inspect pinned objects, kernel version, verifier state
- ✅ Stream real-time events with filtering by pid/comm/cpu
- ✅ Trace kernel errors and system anomalies
- ✅ Discover available tools and their schemas
- ✅ Integrate with Claude, Ollama, or MCP-compatible clients

🧼 All resources are automatically cleaned up when a client disconnects (no manual unload/detach required unless pinned).

. ├── cmd/ # MCP server + CLI client ├── internal/ # Core logic: eBPF, tools, kernel adapters ├── pkg/types/ # JSON schema bindings + shared types ├── docs/ # Tool specs, design notes, schemas ├── scripts/ # Install script + test suite └── schemas/ # JSON Schema files for each tool

- 🔒No manual detach: Links are closed automatically unless pinned
- 🧹Auto cleanup: FDs and memory are released on disconnect
- 📎Pinning: Optional pin paths (/sys/fs/bpf/...) for maps/programs/links

- All tools arestrictly typedwith published schemas and returnstructured JSON output
- AI-ready: No parsing required — direct integration with language models
- Streaming-compatible: Real-time data flows for observability workflows
- Responses include:

- tool_version
- verifier_log(for debugging)
- Structurederrorwithcontext

- pin_object/unpin_object
- detach_link
- map_batch_op

These are omitted from the default for security and simplicity.

Claude / Ollama / AI Client ↓ MCP JSON-RPC ↓ ebpf-mcp server ↓ Kernel APIs

Structured. Safe. Schema-native.ebpf-mcpbrings eBPF to the age of AI.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Enable AI Agents to fix build failures from CircleCI.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.

AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.

MCP server that vets LLM-emitted shell commands BEFORE execution. 30 detection rules across destructive file ops, package managers, system, database, git, network, exfiltration, privilege escalation. Sub-second, local, free.

Give your coding agent the dependency graph it is about to change: scan a source tree, SBOM, Git ref, or container image; explain why a package is present; diff two graphs; check findings against policy.

BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep projects protected.

Breaking Change Alerts for Humans and AI Agents.