Inspektor Gadget MCP Server
The Inspektor Gadget MCP Server bridges Inspektor Gadget's low-level kernel observability with LLMs through the Model Context Protocol (MCP). It turns raw eBPF-powered telemetry—DNS traces, TCP connections, process executions, file activity, syscalls, and more—into actionable intelligence that AI agents can reason over, enabling data-driven root cause analysis directly from your IDE or AI chat interface.
flowchart LR
User["👤 User<br/>(IDE / Chat)"]
LLM["🤖 LLM"]
MCP["⚙️ IG MCP Server"]
IG["🔍 Inspektor Gadget"]
Kernel["🐧 Linux Kernel<br/>(eBPF)"]
K8s["☸️ Kubernetes<br/>Cluster"]
User -- prompt --> LLM
LLM -- MCP tool calls --> MCP
MCP -- run gadgets --> IG
IG -- eBPF hooks --> Kernel
Kernel -. telemetry .-> IG
IG -. enriched data .-> MCP
MCP -. structured JSON .-> LLM
LLM -- analysis & RCA --> User
IG -- metadata --> K8sFeatures
- AI-powered root cause analysis — LLMs correlate low-level kernel data across multiple gadgets to pinpoint issues with confidence, replacing guesswork with evidence.
- Full gadget lifecycle management — Deploy, run, stop, and retrieve results from Inspektor Gadget tools without ever leaving your AI chat.
- Foreground & background modes — Run gadgets in foreground for quick debugging or in background for continuous observability, then retrieve results when ready.
- Dynamic tool registration — Each gadget becomes its own MCP tool (e.g.,
gadget_trace_dns,gadget_trace_tcp), with parameters, field descriptions, and filtering automatically generated from gadget metadata. - Read-only mode — Restrict the server to non-destructive operations for safe production use.
- Flexible deployment — Run as a local binary (stdio), Docker container, or deploy directly into your Kubernetes cluster (HTTP transport).
