MCP Tools Are New API Surfaces. eBPF Sees What They Actually Touch.

An MCP tool call is a tiny line of agent code that fans out to syscalls, library calls, and kernel paths the agent has no view of. TL;DR Through April and early May, vendors shipped MCP servers in bat