#ebpf

Kubescape eBPF agent 🥷🏻

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

Continuous profiling for analysis of CPU and memory usage, down to the line number and throughout time. Saving infrastructure cost, improving performance, and increasing reliability.

Coroot is an open-source observability and APM tool with AI-powered Root Cause Analysis. It combines metrics, logs, traces, continuous profiling, and SLO-based alerting with predefined dashboards and inspections.

eBPF-driven diagnostic tool for Kubernetes applications 🐝

BPF static linker

Koney is a Kubernetes operator that enables you to define so-called deception policies for your cluster. Koney automates the setup, rotation, and teardown of honeytokens and fake API endpoints, and uses eBPF to detect, log, and forward alerts when your traps have been accessed.

Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.

Open-source agent runtime — SSH-native isolation, eBPF egress policy, Kubernetes + LXC backends, GPU passthrough, MCP-native CLI

Near-lock-free structured logging for Rust. 10-crate workspace: MCP server (Claude/Cursor/mcp.run), OTLP HTTP+gRPC exporter, Tower middleware, WASM + WASI 0.2 component, eBPF-style enrichers, PII redaction, log analytics, test utilities, and a jq-style CLI. Sub-µs ingest via a 65k-slot ring buffer (LMAX Disruptor).

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Open-source eBPF compatibility evidence and CI gate

SBPF virtual machine

lightweight system-level observability for AI Agents

Active NDR solution with eBPF-powered active fingerprint blocking, firewall and proxy. Protect your system -- east-west and north-south.