I built an eBPF tool that hooks into the kernel to monitor and enforce policies on LLM/AI traffic in real time — no application changes needed.

It attaches uprobes to OpenSSL's SSL_write/SSL_read to capture decrypted payloads, classifies traffic to 12+ LLM providers (OpenAI, Anthropic, Google, etc.), detects MCP JSON-RPC calls, and can block connections in-kernel via LSM hooks.

You can write inline Rego policies for enforcement. For example, deny any request to Anthropic containing a specific keyword:

sudo busted monitor --enforce --rule 'package busted default decision = "allow" decision = "deny" { input.llm_provider == "Anthropic" contains(input.tls_payload, "secret_project") }' Everything is Rust — eBPF programs, userspace agent, classifier, policy engine, and native egui dashboard. Built with Aya.

https://github.com/barakber/busted