Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF60linux60yeet57AI agents30observability21networking12security10claude-code7containers5sandboxing5HTTP4production4tcpdump4tracing4uprobes4API debugging3bcc3bpftrace3ci3debugging3egress3exectop3incident-response3kubernetes3omarchy3supply chain3TLS3troubleshooting3audit2auditd2BSON2capabilities2cgroups2codex2databases2DNS2execsnoop2hyprland2MongoDB2mysql2oom2packet-capture2performance2permissions2postgres2processes2quickshell2runtime-debugging2ssh2TCP2802.111agent-security1agentic network operations1ai-sre1bar-widget1benchmarks1biolatency1bpf-verifier1bubblewrap1build-performance1Cilium1CO-RE1confidential-computing1context-switches1cpu-accounting1cryptojacking1devops1docker1exfiltration1hardening1integration-testing1kprobes1kworker1landlock1latency1local-llm1logging1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1openssl1opentelemetry1plugin1policy1postinstall1prepared statements1privilege1proc-filesystem1process-attribution1process-masquerading1proctop1profiling1query-shapes1Redis1refusal1RESP1rf1root-cause-analysis1runqlat1schedstat1seccomp1slowlog1SQLite1SSRF1stratum1sudo1syscall1systemd1tcp-retransmits1terminal-bench1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1yeetkit1+123 more

All eBPF60 linux60 yeet57 AI agents30 observability21 networking12 security10 claude-code7 containers5 sandboxing5 HTTP4 production4 tcpdump4 tracing4 uprobes4 API debugging3 bcc3 bpftrace3 ci3 debugging3 egress3 exectop3 incident-response3 kubernetes3 omarchy3 supply chain3 TLS3 troubleshooting3 audit2 auditd2 BSON2 capabilities2 cgroups2 codex2 databases2 DNS2 execsnoop2 hyprland2 MongoDB2 mysql2 oom2 packet-capture2 performance2 permissions2 postgres2 processes2 quickshell2 runtime-debugging2 ssh2 TCP2 802.111 agent-security1 agentic network operations1 ai-sre1 bar-widget1 benchmarks1 biolatency1 bpf-verifier1 bubblewrap1 build-performance1 Cilium1 CO-RE1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 devops1 docker1 exfiltration1 hardening1 integration-testing1 kprobes1 kworker1 landlock1 latency1 local-llm1 logging1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 openssl1 opentelemetry1 plugin1 policy1 postinstall1 prepared statements1 privilege1 proc-filesystem1 process-attribution1 process-masquerading1 proctop1 profiling1 query-shapes1 Redis1 refusal1 RESP1 rf1 root-cause-analysis1 runqlat1 schedstat1 seccomp1 slowlog1 SQLite1 SSRF1 stratum1 sudo1 syscall1 systemd1 tcp-retransmits1 terminal-bench1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1 yeetkit1

September 4, 2026

How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)

An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.

MCPAI agentssupply chainauditeBPFsecuritylinuxyeet

August 24, 2026

How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins

Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.

claude-codeai-agentsauditopentelemetryeBPFobservabilitylinuxyeet