Logira: eBPF Runtime Auditing for AI Agent Runs
Logira is an eBPF-based runtime auditing tool for Linux that tracks what AI agents and automation actually do at the OS level. It records process execution, file activity, and network activity using cgroup v2 run-scoped tracking, attributing events to single audited runs.
Key Features
The tool provides per-run local storage in both JSONL and SQLite formats for timeline review and querying. It includes default detection rules focused on AI agent auditing, with optional custom YAML rules. Logira is observe-only by design—it records and detects but never blocks or enforces.
Default Detections
- Credential and secrets writes:
~/.ssh,~/.aws, kube/gcloud/docker config,.netrc,.git-credentials, registry creds - Sensitive credential reads: SSH private keys, AWS credentials/config, kubeconfig, docker config,
.netrc,.git-credentials - Persistence and config changes: writes under
/etc, systemd units, cron, user autostart entries, shell startup files - Temp droppers: executable files created under
/tmp,/dev/shm,/var/tmp - Suspicious exec patterns:
curl|sh,wget|sh, tunneling/reverse shell tools and flags, base64 decode with shell hints - Agent safety destructive patterns:
rm -rf,git clean -fdx,find -delete,mkfs,terraform destroy, and similar commands - Network egress: suspicious destination ports and cloud metadata endpoint access
Installation
Recommended installation via script:
curl -fsSL https://raw.githubusercontent.com/melonattacker/logira/main/install.sh | sudo bashOr manual install from release tarball:
tar -xzf logira_vX.Y.Z_linux-<arch>.tar.gz
cd logira_vX.Y.Z_linux-<arch>
sudo ./install-local.shAfter installation or upgrade, restart the daemon:
sudo systemctl daemon-reload
sudo systemctl restart logirad.service
sudo systemctl status logirad.service --no-pagerHow to Run
The root daemon logirad runs via systemd. Installation steps include:
# 1) Generate eBPF objects (only needed if missing)
make generate
2) Install the systemd unit
sudo install -D -m 0644 packaging/systemd/logirad.service /etc/systemd/system/logirad.service
3) Install the daemon binary (unit defaults to /usr/local/bin/logirad)
sudo install -m 0755 ./logirad /usr/local/bin/logirad
4) (Recommended) Point systemd at the eBPF .o files via an environment file
sudo mkdir -p /etc/logira
sudo tee /etc/logira/logirad.env > /dev/null << 'EOF'
LOGIRA_EXEC_BPF_OBJ=/absolute/path/to/collector/linux
Custom rules can be appended per-run with logira run --rules <file>.
📖 Read the full source: HN AI Agents
👀 See Also
CK Search: Local Semantic Search Tool with MCP Server Integration
CK Search is a local semantic search tool with a built-in MCP server that indexes any text directory without cloud dependencies. The tool can be used by AI agents via MCP, and the source provides a practical walkthrough covering setup, strengths, and limitations compared to grep.
ETL-D MCP Server: Deterministic CSV Parsing for Claude to Prevent Financial Hallucinations
A developer built ETL-D, an open-source MCP server for Claude Desktop that processes CSVs in three deterministic layers to prevent decimal point hallucinations in financial data. It uses Python parsers for known formats, achieves ~70ms response times with 0 LLM calls for 200 parallel requests, and only uses LLMs as a fallback for high-entropy text.
agentmemory V4 achieves 96.2% on LongMemEval benchmark, outperforms commercial AI memory systems
agentmemory V4 scored 96.2% on LongMemEval, beating several funded AI memory companies including PwC Chronos (95.6%), Mastra (94.87%), and OMEGA (93.2%). The system was built solo in 16 days on a mid-range gaming PC with a $1,000 budget.
Colony: A Local-First Coordination Layer That Cuts Multi-Agent Handoff Tokens from 30K to 400
Colony is a local-first coordination substrate that reduces multi-agent handoff costs from ~30,000 tokens to ~400 by replacing context replay with compact observations stored in SQLite.