Necco Ceresani

The Trivy attack exfiltrated credentials from 10,000+ CI/CD pipelines by reading files it already had access to. We fed the incident report into yeet's AI and built a kernel-level block in hours. Here's what we built — and why it matters for every team running AI coding agents on their infrastructure.

What is eBPF? A simple, non-technical explanation of how eBPF works, why it matters, and how tools like Yeet make kernel-level observability, security, and networking accessible with JavaScript.

The observability industry is built on one invisible assumption: a human is looking at the data. Every design decision — dashboards, static alerts, pre-aggregated metrics, advance instrumentation — follows from that assumption. Two simultaneous shifts are breaking it: production systems now move faster than humans can observe, and AI agents can reason about structured data without any of the affordances the current stack was built to provide. Together, these shifts don't just demand faster tooling — they make the current architecture the wrong abstraction entirely. This post lays out what observability looks like when the primary consumer can reason, and the five first-principles design choices that follow.

Yeet is a programmable kernel runtime that combines eBPF, JavaScript, GraphQL, and AI agents in a single Linux daemon. It replaces generic observability dashboards with bespoke instrumentation tools — custom-built for each application, with kernel-depth visibility, deployed in minutes. Yeet is the first platform where AI agents can read, query, and act on live infrastructure at the kernel level.

Learn about yeet

Claude Code, Codex, Aider and self-hosted agents run with your full filesystem access and choose what to read on their own — here are the six real ways to confine one, what each actually covers, and why the built-in sandboxes govern shell commands rather than the agent's own file reads.

A WebSocket integration test asserts on what your client library returned, which is not what crossed the connection. How to see the real frames inside wss:// on Linux with wssnoop, Wireshark and a TLS keylog, mitmproxy and Chrome DevTools, and how to turn a captured session into a fixture your test suite can replay.

A sidecar proxy sees the traffic you routed through it. The kernel's TC layer sees what actually crossed the wire, including loopback, without anything being rerouted. Compares OpenTelemetry, Envoy, tcpdump, Pixie, Cilium Hubble and httpwatch, and how to pick the one that answers your question.

How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.