Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF30linux29yeet26observability12AI agents9security7networking4uprobes4claude-code3exectop3kubernetes3supply chain3tcpdump3tracing3audit2bcc2BSON2ci2containers2execsnoop2HTTP2incident-response2MongoDB2process-attribution2processes2802.111agent-security1ai-sre1auditd1biolatency1bpf-verifier1bpftrace1build-performance1capabilities1cgroups1Cilium1CO-RE1confidential-computing1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1integration-testing1kprobes1kworker1local-llm1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1oom1opentelemetry1packet-capture1postinstall1prepared statements1proc-filesystem1process-masquerading1production1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1sandboxing1schedstat1slowlog1SQLite1ssh1stratum1sudo1tcp-retransmits1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1+85 more

All eBPF30 linux29 yeet26 observability12 AI agents9 security7 networking4 uprobes4 claude-code3 exectop3 kubernetes3 supply chain3 tcpdump3 tracing3 audit2 bcc2 BSON2 ci2 containers2 execsnoop2 HTTP2 incident-response2 MongoDB2 process-attribution2 processes2 802.111 agent-security1 ai-sre1 auditd1 biolatency1 bpf-verifier1 bpftrace1 build-performance1 capabilities1 cgroups1 Cilium1 CO-RE1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 egress1 exfiltration1 integration-testing1 kprobes1 kworker1 local-llm1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 oom1 opentelemetry1 packet-capture1 postinstall1 prepared statements1 proc-filesystem1 process-masquerading1 production1 profiling1 query-shapes1 Redis1 RESP1 rf1 root-cause-analysis1 runqlat1 sandboxing1 schedstat1 slowlog1 SQLite1 ssh1 stratum1 sudo1 tcp-retransmits1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1

September 4, 2026

How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)

An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.

MCPAI agentssupply chainauditeBPFsecuritylinuxyeet

August 24, 2026

How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins

Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.

claude-codeai-agentsauditopentelemetryeBPFobservabilitylinuxyeet