monitor-process - Monitor process runtime behavior using eBPF.
Monitors process behavior including file access, network connections, process creation, and system calls for debugging, auditing, and anomaly detection.
Tags
Updated: 2026-09-19Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Register processes for eBPF tracing
- Configure path tracking rules
- Query real-time process system events
- Tail historical event logs
- Check system health metrics
- Block suspicious network and file access
Inputs
- Process ID or command name
- Target tracked file path
- Event query filter criteria
- MCP tool parameters
Outputs
- Process system call event data
- Historical event trace logs
- System health status metrics
- Security risk alerts
- Process and network isolation state
Requirements
- Linux kernel eBPF support
- System level event tracing privileges
- Compatible MCP tools environment