1247 matches found
mcpguard-dynamic
MCPGuard-Dynamic Kernel-level sandboxing for LLM agent tool calls made through the Model Context Protocol MCP. MCPGuard sits as a transparent proxy between an MCP client the agent / runner and an MCP server subprocess, applying three layered defenses to every tool invocation. The lowest layer is...
sigwire
sigwire tail -f for signals. Every signal any process on the box raises — who sent it, who it hit, which signal, how it was raised kill2, the kernel, a POSIX timer, whether the target caught it and how long its handler ran, whether it tore a blocked syscall out with EINTR — decoded off the kernel...
logira
logira OS-level runtime auditing for unpredictable automation. logira is an observe-only Linux CLI that records runtime exec, file, and net events via eBPF. It helps you see what actually happened during AI agent runs and other forms of automation, with per-run local storage for auditing, post-ru...
bandwhich
bandwhich This is a CLI utility for displaying current network utilization by process, connection and remote IP/hostname Table of contents bandwhich Table of contents Project status How does it work? Installation Downstream packaging status Download a prebuilt binary Building from source...
azazel
Azazel A lightweight eBPF-based runtime security tracer purpose-built for malware analysis sandboxes. Drop a sample into an isolated container, and Azazel captures every syscall, file touch, network connection, and suspicious behavior, then hands you a clean JSON stream of everything that happene...
vc5
VC5 This README is currently being updated to reflect recent changes - some information may not reflect the current codebase. This iteration of code is not yet battle ready - use a v0.2 release for production A horizontally scalable Direct Server Return DSR layer 4 load balancer L4LB for Linux...
gobee
gobee Write your BPF programs in Go, not C. gobee transpiles a strict subset of Go into BPF C, generates typed Go bindings for the userspace side, and gates loads against the running kernel. The Go ecosystem has solid userspace tooling for BPF. The kernel side has always ended with "now write you...
psc
psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...
guardd
Guardd Behavioral anomaly detection for Linux, powered by eBPF and machine learning. Guardd learns how a Linux host normally behaves and flags activity that differs from that baseline. Kernel sensors collect process executions and outbound TCP connection attempts; an Isolation Forest scores the...
owLSM
🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...
kerneleye
KernelEye Kernel-level traffic intelligence and threat remediation for Linux servers. KernelEye is a self-hosted security monitoring platform for Linux servers. It uses eBPF, TC, and XDP in a Go agent to observe network metadata, score suspicious activity, and apply remediation through kernel-lev...
ltm
ltm Machine-history debugger for Linux. Records process, file, network, memory, and block I/O via eBPF, stores metadata in SQLite, and answers timeline / diff / plain-English / SQL questions about what happened on the box. ⚠️ Tracepoint-only capture today — recording currently uses tracepoint...
CVE-2022-23222
CVE-2022-23222 Chinese writeup: https://tr3e.ee/posts/cve-2022-23222-linux-kernel-ebpf-lpe.txt For educational/research purposes only. Use at your own risk. Build & Run $ make cc -I include -static -w -o exploit exploit.c $ ./exploit phase1/8 'create bpf maps' running + phase1/8 'create bpf maps'...
OshoosiClaw
🏹 OpenỌ̀ṣọ́ọ̀sì — OshoosiClaw The Decentralized Immune System for the Modern Endpoint OshoosiClaw OpenỌ̀ṣọ́ọ̀sì is an enterprise-grade, decentralized Endpoint Detection & Response EDR immune system engineered in high-assurance Rust and Python. It combines pre-execution kernel blocking, post-quantum...
linnix
Linnix Find which process is hurting your SLOs — not just who's using CPU, but who's causing stalls. The Problem top shows 80% CPU. Prometheus shows high latency. But which pod is actually stalling your payment service? Linnix uses eBPF + PSI Pressure Stall Information to answer this. PSI measure...
kprotect
🛡️ kprotect Overview kprotect is a kernel-level security engine designed to protect your sensitive data from supply-chain attacks like malicious Python or Node.js libraries. It stands as an independent security layer for the most sensitive files. eBPF-LSM Enforcement : Intercepts file access at th...
BPFDoor-controller-source
BPFDoor-controller-source Source code to recent BPFDoor's controller variant Original: 2eacc8d91b9829b9606a7945fc5311fb5876cfb42ffccc1b91f61841237b04c1 Fixed: bpfdoorcontroller.c Original to fixed helper: formatfix.py Compile: $ apt install libssl-dev $ gcc -Wno-implicit-function-declaration...
buzzer
Buzzer - An eBPF Fuzzer toolchain Buzzer is a fuzzer toolchain that allows to write eBPF fuzzing strategies. A Fuzzing strategy is a way to generate random eBPF Programs and then validate that they don't have unexpected behaviour. To run the fuzzer follow the next steps 1. Install bazel. 2. Insta...
wg.copyfail.patch
CVE-2026-31431 aka Copy.Fail eBPF workaround Why it matters This CVE allows authorized user change cache copy of any readable file, which leads to Local Privilege Escalation aka local root exploit, sandbox/container escape and other issues. It works by creating AFALG socket that is provided by...