MCPcopy Index your code
hub / github.com/KernelErr/foxear

github.com/KernelErr/foxear @main

Chat with this repo
repository ↗ · DeepWiki ↗ · + Follow
65 symbols 116 edges 22 files 2 documented · 3%
What it actually does AI analysis from the code graph — generated when you open this
loading…
README

Banner

Fox Ear

Fox Ear is a Linux process behavior trace tool powered by eBPF.

Banner image by Birger Strahl on Unsplash.

Features

  • Log process and its subprocesses' creation and create a graph.
  • Log processes' file access.
  • Log processes' TCP connection(IPv4 and IPv6).

Documents

License

Fox Ear is available under the MPL-2.0 license. You can read an explanation about it, but only the full text of MPL-2.0 has legal effect.

Fox Ear used some parts of following projects:

  • Probes - bcc (Apache-2.0)

Extension points exported contracts — how you extend this code

AbtractProbe (Interface)
(no doc) [3 implementers]
src/ebpf/mod.rs

Core symbols most depended-on inside this repo

ensure_exists
called by 5
src/visualization/utils.rs
read_u8_string
called by 5
src/ebpf/utils.rs
read_struct
called by 4
src/ebpf/utils.rs
fliter_so_file
called by 2
src/storage/utils.rs
print_commands
called by 2
src/cli/check.rs
trace_connect_return
called by 2
probes/tcpconnect.c
start
called by 1
src/server.rs
ps
called by 1
src/visualization/exec.rs

Shape

Function 32
Class 23
Enum 5
Method 4
Interface 1

Languages

Rust66%
C34%

Modules by API surface

probes/tcpconnect.c13 symbols
probes/execsnoop.c9 symbols
src/ebpf/tcpconnect.rs6 symbols
src/storage/types.rs5 symbols
src/ebpf/execsnoop.rs5 symbols
src/ebpf/opensnoop.rs4 symbols
src/visualization/connect.rs3 symbols
src/storage/utils.rs3 symbols
src/visualization/open.rs2 symbols
src/visualization/exec.rs2 symbols
src/ebpf/utils.rs2 symbols
src/ebpf/mod.rs2 symbols

For agents

$ claude mcp add foxear \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact