Inspektor Gadget MCP 服务器通过模型上下文协议（MCP）桥接了 Inspektor Gadget 的低级内核可观察性与大型语言模型（LLM）。它将原始的 eBPF 驱动的遥测数据——DNS 追踪、TCP 连接、进程执行、文件活动、系统调用等——转化为可操作的智能，AI 代理可以推理，实现基于数据的根本原因分析，直接从您的 IDE 或 AI 聊天界面实现。

特色

• AI驱动的根因分析 — 大型语言模型将底层内核数据跨多个设备关联，自信地定位问题，用证据取代猜测。
• 完整的设备生命周期管理 — 部署、运行、停止和检索Inspektor工具工具的结果，而无需离开你的AI聊天。
• 前景模式与背景模式 — 在前景运行小工具以便快速调试，或在后台运行以实现连续可观测，准备好后再检索结果。
• 动态工具注册 — 每个设备都成为独立的MCP工具（例如，gadget_trace_dns，gadget_trace_tcp），参数、字段描述和过滤自动从设备元数据生成。

Inspektor Gadget MCP Server

The Inspektor Gadget MCP Server bridges Inspektor Gadget’s low-level kernel observability with LLMs through the Model Context Protocol (MCP). It turns raw eBPF-powered telemetry—DNS traces, TCP connections, process executions, file activity, syscalls, and more—into actionable intelligence that AI agents can reason over, enabling data-driven root cause analysis directly from your IDE or AI chat interface.

flowchart LR
    User["👤 User(IDE / Chat)"]
    LLM["🤖 LLM"]
    MCP["⚙️ IG MCP Server"]
    IG["🔍 Inspektor Gadget"]
    Kernel["🐧 Linux Kernel(eBPF)"]
    K8s["☸️ KubernetesCluster"]

    User -- prompt --> LLM
    LLM -- MCP tool calls --> MCP
    MCP -- run gadgets --> IG
    IG -- eBPF hooks --> Kernel
    Kernel -. telemetry .-> IG
    IG -. enriched data .-> MCP
    MCP -. structured JSON .-> LLM
    LLM -- analysis & RCA --> User
    IG -- metadata --> K8s

Features

• AI-powered root cause analysis — LLMs correlate low-level kernel data across multiple gadgets to pinpoint issues with confidence, replacing guesswork with evidence.
• Full gadget lifecycle management — Deploy, run, stop, and retrieve results from Inspektor Gadget tools without ever leaving your AI chat.
• Foreground & background modes — Run gadgets in foreground for quick debugging or in background for continuous observability, then retrieve results when ready.
• Dynamic tool registration — Each gadget becomes its own MCP tool (e.g., gadget_trace_dns, gadget_trace_tcp), with parameters, field descriptions, and filtering automatically generated from gadget metadata.
• Read-only mode — Restrict the server to non-destructive operations for safe production use.
• Flexible deployment — Run as a local binary (stdio), Docker container, or deploy directly into your Kubernetes cluster (HTTP transport).

Background

The observability gap