inspektor-gadget/ig-mcp-server

The Inspektor Gadget MCP Server bridges Inspektor Gadget's low-level kernel observability with LLMs through the Model Context Protocol (MCP). It turns raw eBPF-powered telemetry—DNS traces, TCP connections, process executions, file activity, syscalls, and more—into actionable intelligence that AI agents can reason over, enabling **data-driven root cause analysis** directly from your IDE or AI chat interface.
Features
- **AI-powered root cause analysis** — LLMs correlate low-level kernel data across multiple gadgets to pinpoint issues with confidence, replacing guesswork with evidence.
- **Full gadget lifecycle management** — Deploy, run, stop, and retrieve results from Inspektor Gadget tools without ever leaving your AI chat.
- **Foreground & background modes** — Run gadgets in foreground for quick debugging or in background for continuous observability, then retrieve results when ready.
- **Dynamic tool registration** — Each gadget becomes its own MCP tool (e.g., gadget_trace_dns, gadget_trace_tcp), with parameters, field descriptions, and filtering automatically generated from gadget metadata.
- **Read-only mode** — Restrict the server to non-destructive operations for safe production use.
- **Flexible deployment** — Run as a local binary (stdio), Docker container, or deploy directly into your Kubernetes cluster (HTTP transport).
Background
The observability gap
Kubernetes troubleshooting is hard. Traditional tools give you logs, metrics, and high-level resource states—but when things go wrong at the network, syscall, or kernel level, there's a gap between _what you can see_ and _what's actually happening_.
Inspektor Gadget fills this gap. It provides modular observability units called **gadgets**—eBPF programs that hook into the Linux kernel to collect low-level telemetry data in real time. Gadgets can trace DNS queries, TCP connections, process executions, file opens, signals, OOM kills, syscalls, and much more, all enriched with Kubernetes metadata (pod, namespace, container, node).
Why LLMs change the game
This kernel-level data is a superpower, but it's also _dense_. A single 10-second DNS trace can produce hundreds of events across dozens of pods. Manually sifting through raw telemetry to correlate events, spot anomalies, and identify root causes requires deep expertise and significant time.
LLMs are the missing piece. By exposing Inspektor Gadget through MCP, AI agents can:
1. **Autonomously select the right gadgets** — Given a problem description, the LLM decides which telemetry to collect (DNS traces? TCP connections? Process executions?) without you needing to know which gadget to run.
2. **Correlate across data sources** — The AI can run multiple gadgets, cross-reference their outputs, and build a complete picture of what happened.
3. **Perform confident, data-driven RCA** — Instead of speculating, the LLM grounds its analysis in real kernel-level evidence, identifying the exact DNS lookup that failed, the precise TCP connection that was refused, or the specific process that triggered an OOM kill.
4. **Explain findings in plain language** — Raw eBPF output becomes a clear, actionable summary with concrete next steps.
See it in action
The AI selects relevant gadgets, collects data, and analyzes results—all in a single conversational flow:
https://github.com/user-attachments/assets/0f146943-3bf9-4c4d-90c8-76a101d7a4b4
> The LLM autonomously runs gadget_tcpdump and gadget_snapshot_socket to capture TCP connection RESET events, then analyzes the enriched telemetry to identify the exact connection that was refused, correlating it with the pod and container metadata to provide a precise root cause analysis.