███╗ ███╗ ██████╗██████╗ ███████╗██████╗ ██╗ ██╗ ████╗ ████║██╔════╝██╔══██╗██╔════╝██╔══██╗╚██╗ ██╔╝ ██╔████╔██║██║ ██████╔╝███████╗██████╔╝ ╚████╔╝ ██║╚██╔╝██║██║ ██╔═══╝ ╚════██║██╔═══╝ ╚██╔╝ ██║ ╚═╝ ██║╚██████╗██║ ███████║██║ ██║ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚══════╝╚═╝ ╚═╝

MCPSpy - eBPFを用いたモデルコンテキストプロトコル通信のリアルタイム監視

概要

MCPSpyは、eBPF(Extended Berkeley Packet Filter)技術を活用し、カーネルレベルでモデルコンテキストプロトコル(MCP)通信を監視する強力なコマンドラインツールです。低レベルのシステムコールにフックすることで、MCPクライアントとサーバー間で交換されるJSON-RPC 2.0メッセージをリアルタイムで可視化します。

モデルコンテキストプロトコルは、通信のための3つのトランスポートプロトコルをサポートしています。

• Stdio:標準的な入出力ストリームによる通信
• Streamable HTTP:サーバー送信イベントによる直接的なHTTPリクエスト/レスポンス通信
• SSE(サーバー送信イベント):HTTPベースのストリーミング通信(Deprecated)

MCPSpyはStdioおよびHTTP/HTTPSトランスポート(サーバー送信イベントを含む)の両方の監視をサポートし、MCP通信チャネルの包括的なカバレッジを提供します。

なぜMCPSpyなの?

MCPSpy - MCP Monitoring with eBPF 🕵️✨

Overview

MCPSpy is a powerful command-line tool that leverages eBPF (Extended Berkeley Packet Filter) technology to monitor Model Context Protocol (MCP) communication at the kernel level. It provides real-time visibility into JSON-RPC 2.0 messages exchanged between MCP clients and servers by hooking into low-level system calls.

The Model Context Protocol supports three transport protocols for communication:

• Stdio: Communication over standard input/output streams
• Streamable HTTP: Direct HTTP request/response communication with server-sent events
• SSE (Server-Sent Events): HTTP-based streaming communication (Deprecated)

MCPSpy supports monitoring of both Stdio and HTTP/HTTPS transports (including Server-Sent Events), providing comprehensive coverage of MCP communication channels.

Why MCPSpy?

The Model Context Protocol is becoming the standard for AI tool integration, but understanding what’s happening under the hood can be challenging. MCPSpy addresses this by providing:

• 🔒 Security Analysis: Monitor what data is being transmitted, detect PII leakage, and audit tool executions
• 🛡️ Prompt Injection Detection: Real-time detection of prompt injection and jailbreak attempts using ML models
• 🐛 Debugging: Troubleshoot MCP integrations by seeing the actual message flow
• 📊 Performance Monitoring: Track message patterns and identify bottlenecks
• 🔍 Compliance: Ensure MCP communications meet regulatory requirements
• 🎓 Learning: Understand how MCP works by observing real communications

Installation

Prerequisites

• Linux kernel version 5.15 or later
• Root privileges (required for eBPF)

Download Pre-built Binary (Auto-detect OS + Arch)

Download the latest release from the release page:

# Set platform-aware binary name
BIN="mcpspy-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')"

# Download the correct binary
wget "https://github.com/alex-ilgayev/mcpspy/releases/latest/download/${BIN}"