Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)
An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.
Can an AI Coding Agent Exfiltrate My Source Code? What a Domain Allowlist Decides, and What It Doesn't (2026)
A domain allowlist decides whether a connection may open, not what goes through it, and the proxy in front of your agent does not read TLS by default. Here are the six ways to control agent egress on Linux in 2026, what each one covers, and how to see every host your agent dialed with claudefeed.
How to Check if a Linux Box Is Cryptomining in 2026: A kworker With a Socket Is Not a kworker
A kworker pegging a core is usually a firmware interrupt storm, but a kworker moving bytes to a mining pool is a renamed userspace process. Detect cryptojacking on Linux in 2026 by reading the name in the kernel at send time, after prctl(PR_SET_NAME) edited what ps and top show.
How to Sandbox and Monitor an AI Agent on Linux in 2026: Why a Proxy Can't Tell You Which Process Spoke
Five questions about an AI coding agent's egress that a MITM proxy, a container and an HTTPS_PROXY variable structurally cannot answer, ranked by how much of the answer survives the agent doing something you did not anticipate. Compared against AgentSight, Claude Code's built-in proxy, Dev Proxy, Landlock and microVMs, with the kernel hook that answers each and what it costs to run.
How to Sandbox an AI Coding Agent on Linux in 2026: What the Kernel Can Refuse That Permissions Only Ask About
Claude Code, Codex, Aider and self-hosted agents run with your full filesystem access and choose what to read on their own — here are the six real ways to confine one, what each actually covers, and why the built-in sandboxes govern shell commands rather than the agent's own file reads.