Trace your LLM API and MCP calls with zero code changes (eBPF, Linux)

Reddit r/LocalLLaMA / 3/12/2026

📰 NewsDeveloper Stack & InfrastructureTools & Practical Usage

共有:

Key Points

An eBPF-based tracer is introduced that can capture LLM API and MCP traffic from any process on a Linux machine without SDK changes, proxies, or code instrumentation.
It intercepts TLS via OpenSSL uprobes and can parse calls to Anthropic, OpenAI, and Gemini in real time, extracting model, tokens, latency, TTFT, tool names, streaming status, and full request/response bodies.
It also traces MCP calls over stdio/socketpairs and HTTP, so uses of Claude Code tool appear in traces as well; outputs JSONL and can export to OpenTelemetry and Prometheus.
The tool is Linux-only, requires root for eBPF probes, and works with Python, Node.js, and any app using OpenSSL with exported symbols, but not with Go, Bun, Deno, or rustls.
GitHub repository: https://github.com/zhebrak/agtap

Trace your LLM API and MCP calls with zero code changes (eBPF, Linux)

Built an eBPF-based tracer that captures LLM API and MCP traffic from any process on your machine — no SDK changes, no proxy, no code instrumentation.

It intercepts TLS via OpenSSL uprobes and parses Anthropic, OpenAI, and Gemini API calls in real time. Extracts model, tokens, latency, TTFT, tool names, streaming status, and full request/response bodies. Also traces MCP calls over stdio/socketpairs and HTTP (so Claude Code tool use shows up too).

Outputs JSONL, exports to OpenTelemetry and Prometheus.

Linux only, needs root for eBPF probes. Works with Python, Node.js, and anything using OpenSSL with exported symbols. Doesn't work with Go, Bun, Deno, or rustls.

GitHub: https://github.com/zhebrak/agtap

submitted by /u/zhebrak
[link] [comments]