Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF22linux21yeet18observability11AI agents5security5networking4uprobes4kubernetes3tcpdump3audit2BSON2containers2HTTP2MongoDB2process-attribution2tracing2802.111ai-sre1bcc1biolatency1bpf-verifier1bpftrace1cgroups1Cilium1claude-code1CO-RE1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1incident-response1integration-testing1kprobes1kworker1MCP1memory1n-plus-one1off-cpu1oom1opentelemetry1packet-capture1prepared statements1proc-filesystem1process-masquerading1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1slowlog1SQLite1stratum1supply chain1tcp-retransmits1tunnels1websocket1wifi1wireguard1wireless1wss1+65 more

September 4, 2026

How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)

An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.

MCPAI agentssupply chainauditeBPFsecuritylinuxyeet

August 24, 2026

How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins

Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.

claude-codeai-agentsauditopentelemetryeBPFobservabilitylinuxyeet