███╗ ███╗ ██████╗██████╗ ███████╗██████╗ ██╗ ██╗ ████╗ ████║██╔════╝██╔══██╗██╔════╝██╔══██╗╚██╗ ██╔╝ ██╔████╔██║██║ ██████╔╝███████╗██████╔╝ ╚████╔╝ ██║╚██╔╝██║██║ ██╔═══╝ ╚════██║██╔═══╝ ╚██╔╝ ██║ ╚═╝ ██║╚██████╗██║ ███████║██║ ██║ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚══════╝╚═╝ ╚═╝

MCPSpy - eBPF를 이용한 모델 컨텍스트 프로토콜 통신의 실시간 모니터링

개요

MCPSpy는 eBPF(확장 버클리 패킷 필터) 기술을 활용하여 커널 수준에서 모델 컨텍스트 프로토콜(MCP) 통신을 모니터링하는 강력한 명령줄 도구입니다. MCPSpy는 저수준 시스템 호출에 연결하여 MCP 클라이언트와 서버 간에 교환되는 JSON-RPC 2.0 메시지를 실시간으로 가시화합니다.

모델 컨텍스트 프로토콜은 통신을 위한 세 가지 전송 프로토콜을 지원합니다:

• Stdio: 표준 입출력 스트림을 통한 통신
• 스트리밍 가능한 HTTP: 서버에서 전송된 이벤트와 직접 HTTP 요청/응답 통신
• SSE (서버-전송 이벤트): HTTP 기반 스트리밍 통신 (Deprecated)

**MCPSpy는 Stdio 및 HTTP/HTTPS 전송(서버 전송 이벤트 포함)을 모니터링하여 MCP 통신 채널을 포괄적으로 커버합니다.

왜 MCPSpy인가요?

MCPSpy - MCP Monitoring with eBPF 🕵️✨

Overview

MCPSpy is a powerful command-line tool that leverages eBPF (Extended Berkeley Packet Filter) technology to monitor Model Context Protocol (MCP) communication at the kernel level. It provides real-time visibility into JSON-RPC 2.0 messages exchanged between MCP clients and servers by hooking into low-level system calls.

The Model Context Protocol supports three transport protocols for communication:

• Stdio: Communication over standard input/output streams
• Streamable HTTP: Direct HTTP request/response communication with server-sent events
• SSE (Server-Sent Events): HTTP-based streaming communication (Deprecated)

MCPSpy supports monitoring of both Stdio and HTTP/HTTPS transports (including Server-Sent Events), providing comprehensive coverage of MCP communication channels.

Why MCPSpy?

The Model Context Protocol is becoming the standard for AI tool integration, but understanding what’s happening under the hood can be challenging. MCPSpy addresses this by providing:

• 🔒 Security Analysis: Monitor what data is being transmitted, detect PII leakage, and audit tool executions
• 🛡️ Prompt Injection Detection: Real-time detection of prompt injection and jailbreak attempts using ML models
• 🐛 Debugging: Troubleshoot MCP integrations by seeing the actual message flow
• 📊 Performance Monitoring: Track message patterns and identify bottlenecks
• 🔍 Compliance: Ensure MCP communications meet regulatory requirements
• 🎓 Learning: Understand how MCP works by observing real communications

Installation

Prerequisites

• Linux kernel version 5.15 or later
• Root privileges (required for eBPF)

Download Pre-built Binary (Auto-detect OS + Arch)

Download the latest release from the release page:

# Set platform-aware binary name
BIN="mcpspy-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')"

# Download the correct binary
wget "https://github.com/alex-ilgayev/mcpspy/releases/latest/download/${BIN}"