一个安全、简约且基于模式强制的eBPF管理MCP服务器——专为AI集成、内核内核内省和自动化而设计。

---

🧠 这是什么？

ebpf-mcp 是一个安全的 模型上下文协议（MCP）服务器，提供最简的结构化工具以与eBPF交互——优化为安全的人工智能控制、自动化代理和人工操作员。

它支持加载、附加、内省和流式传输eBPF程序——所有这些都通过严格的JSON模式契约在运行时验证。没有REST API，没有shell转义，也没有bpftool封装器。

---

🚀 快速启动

📦 一句台词装置

对于空气间隔或开发环境：

🧪 测试安装

如果没有提供令牌，脚本会交互式地提示该令牌。

---

🤖 Claude CLI 集成

安装完成后，将Claude连接到你的eBPF服务器（运行在8080端口）：

📘 教程

想在特定环境或使用Cursor IDE开始？

🧰 VirtualBox 设置指南

学习如何在VirtualBox虚拟机中配置和运行ebpf-mcp，包括端口转发、SSH访问以及实用技巧。

🖥️ 光标IDE + eBPF-MCP集成

🐝 ebpf-mcp: AI-Compatible eBPF Control via Model Context Protocol

A secure, minimal, and schema-enforced MCP server for eBPF — purpose-built for AI integration, kernel introspection, and automation.

---

🧠 What Is This?

ebpf-mcp is a secure Model Context Protocol (MCP) server that exposes a minimal set of structured tools to interact with eBPF — optimized for safe AI control, automation agents, and human operators.

It enables loading, attaching, introspecting, and streaming eBPF programs — all through strict JSON Schema contracts validated at runtime. No REST APIs, no shell escapes, and no bpftool wrappers.

---

🚀 Quick Start

📦 One-liner Installation

# Install ebpf-mcp server
curl -fsSL https://raw.githubusercontent.com/sameehj/ebpf-mcp/main/install.sh | sudo bash

# Start the service (runs on port 8080 by default)
sudo systemctl start ebpf-mcp
sudo systemctl enable ebpf-mcp

# Get your auth token
cat /etc/ebpf-mcp-token

# Check service status
sudo systemctl status ebpf-mcp

# View logs if needed
sudo journalctl -u ebpf-mcp -f

For air-gapped or development environments:

git clone https://github.com/sameehj/ebpf-mcp.git
cd ebpf-mcp
sudo ./install.sh v1.0.2

🧪 Test the Installation

# Run the complete test suite
cd scripts/
chmod +x test-ebpf-mcp-server.sh
./test-ebpf-mcp-server.sh 

If no token is provided, the script will prompt for it interactively.

---

🤖 Claude CLI Integration

Once installed, connect Claude to your eBPF server (runs on port 8080):

# Add MCP server to Claude CLI
claude mcp add ebpf http://localhost:8080/mcp \
  -t http \
  -H "Authorization: Bearer $(cat /etc/ebpf-mcp-token)"

# Start Claude with eBPF tools
claude --debug

# Optional: Test with MCP Inspector (requires Node.js)
npx @modelcontextprotocol/inspector http://localhost:8080/mcp

📘 Tutorials

Looking to get started in specific environments or with Cursor IDE?

🧰 VirtualBox Setup Guide

Learn how to configure and run ebpf-mcp inside a VirtualBox VM, with port forwarding, SSH access, and practical tips.

🖥️ Cursor IDE + eBPF-MCP Integration

Step-by-step guide for running the eBPF MCP server with Cursor IDE for AI-driven observability.

Example prompts: