That table is the most useful thing on the page: it tells you in advance which half of the toolset works without privilege escalation, so a read-only observability setup is a deliberate configuration rather than a hope. The automatic cleanup on disconnect matters just as much — an agent that drops mid-session does not leave attached programs behind unless something was explicitly pinned. Extra tools like detach and pinning are named in the README as deliberately left out.
An MCP server for eBPF on Linux. Every tool has a JSON Schema validated at runtime, and the server talks to the kernel directly rather than shelling out, which is what makes it safe to hand to an agent.
- info reports kernel version, architecture and BTF availability, read-only and requiring no special capability
- load_program loads and validates .o files with CO-RE support, from disk or inline base64
- attach_program attaches to XDP, kprobe and tracepoint hooks with type-safe constraints
- inspect_state lists programs, maps, links and tool metadata, read-only
- stream_events streams from ringbuf and perfbuf maps with filtering by pid, comm or cpu
- trace_errors watches kernel tracepoints for error conditions
- Every tool returns structured JSON including tool_version, the verifier log for debugging, and a structured error with context
- Links close and file descriptors release automatically when a client disconnects, unless the object was pinned
Linux 5.8 or newer, installed with the project's install script and run as a systemd service on port 8080. Authentication is a bearer token written to /etc/ebpf-mcp-token at install time. Capabilities depend on the tool: read-only introspection needs CAP_BPF, loading needs CAP_BPF or CAP_SYS_ADMIN, and attaching depends on the hook — XDP needs CAP_NET_ADMIN.
One command — curl -fsSL https://raw.githubusercontent.com/sameehj/ebpf-mcp/main/install.sh | sudo bash