Logira – eBPF runtime auditing for AI agent runs

Name: Logira – eBPF runtime auditing for AI agent runs
Availability: InStock
Author: melonattacker

by melonattacker·Mar 1, 2026·26 points·3 comments

Visit Project View on HN

AI Analysis

●●●BangerSolve My ProblemWizardry

eBPF runtime visibility for AI agents—first tool solving the trust problem with Claude Code and similar.

Strengths

•Addresses genuine security blind spot (agents lying about what they did) with OS-level truth
•eBPF + cgroup v2 scoping is technically sound; observe-only design avoids false-positive enforcement
•Built-in detection rules for credential access, persistence, destructive patterns match real agent risks

Weaknesses

•Linux-only severely limits adoption in mixed-OS teams; macOS and Windows support TBD
•Early tooling: no UI for browsing events, no integration with CI/CD systems yet

Post Description

I started using Claude Code (claude --dangerously-skip-permissions) and Codex (codex --yolo) and realized I had no reliable way to know what they actually did. The agent's own output tells you a story, but it's the agent's story.

logira records exec, file, and network events at the OS level via eBPF, scoped per run. Events are saved locally in JSONL and SQLite. It ships with default detection rules for credential access, persistence changes, suspicious exec patterns, and more. Observe-only – it never blocks.

https://github.com/melonattacker/logira