Netra

eBPF network observability and safe emergency control for Linux and Kubernetes.

Connector by zyvorai · GitHub account verified by the MCP Registry

IndexedLicense unknownLocal (stdio)★ 5

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/zyvorai-netra

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

eBPF network observability and safe emergency control for Linux and Kubernetes.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools: 5 read · 5 write · 0 delete · 6 not yet classified
Secrets: 1 (API keys, tokens or passwords)
Install scripts: None found
Runs as: Docker image

Tools by what they do 16

Read from the source code; the running server may list different tools.

Read 5 · Look things up without changing anything.

netra_ebpf_auto_mitigate
netra_intel_feed_get
netra_intel_preview
netra_policy_plan
netra_policy_simulate

Write 5 · Create, change, send or run things.

netra_ebpf_netpol_default_deny_set
netra_intel_apply
netra_intel_feed_put
netra_policy_apply
netra_policy_history_import

Not yet classified 6 · We could not tell from the name and description.

netra_ebpf_ai_destinations
netra_ebpf_ai_destinations_deny
netra_intel_hits
netra_policy_gitops_resync
netra_watchlist_match
unknown

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

NETRA_API_KEY

Other settings (environment variables or headers).

NETRA_MCP_ACTOR
NETRA_MCP_ALLOW_MUTATIONS
NETRA_URL

Files it touches

/dev/kmsg
/etc/netra/apps.yaml
/etc/netra/metricalert.d
/etc/rancher/k3s/k3s.yaml
/opt/netra
/opt/netra/bpf/netra_capture.o
/opt/netra/bpf/netra_dropinfo.o
/opt/netra/bpf/netra_edge_intel.o
/opt/netra/bpf/netra_l7sample.o
/opt/netra/bpf/netra_nodeiso.o
/opt/netra/bpf/netra_rtnl.o
/opt/netra/bpf/netra_ssl.o
/opt/netra/bpf/netra_tc.o
/opt/netra/bpf/netra_tcpevents.o
/opt/netra/bpf/netra_tlsfp.o
/proc
/proc/1/root
/proc/kallsyms
/proc/net/ipv6_route
/proc/net/netstat
/proc/net/route
/proc/net/softnet_stat
/proc/net/tcp
/proc/net/tcp6
/proc/self/cgroup
/proc/self/comm
/proc/self/mountinfo
/proc/self/ns/net
/proc/self/status
/proc/softirqs
/proc/stat
/proc/sys
/proc/sys/kernel/osrelease
/proc/sys/kernel/unprivileged_bpf_disabled
/proc/sys/net/ipv6/conf
/sys/class/net
/sys/fs/bpf
/sys/fs/bpf/netra
/sys/fs/bpf/netra-ci-mtls
/sys/fs/bpf/tetragon

Tools (16)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

netra_ebpf_ai_destinations
Observe known GenAI/MCP SaaS destinations via SNI/HTTP Host/DNS metadata. No payloads. Applies nothing.
netra_ebpf_ai_destinations_deny
Lease-deny currently observed GenAI/MCP SaaS SNI hosts. Requires mode=enforce with an active lease and confirm_risk=high. Metadata only.
netra_ebpf_auto_mitigate
Status of optional volumetric auto-mitigation (conn-rate / Shield / leased deny). Observe-only.
netra_ebpf_netpol_default_deny_set
Activate or deactivate v2 default-deny for a workload selector. Requires plan_token from a prior netra_ebpf_netpol_default_deny_plan call with the identical selector/enabled/lease (tokens are single-use, 5-minute). If the plan's risk was "medium" or higher, confirm_risk must equal that risk. This is the single highest-blast-radius mutation in the firewall feature — a workload in default-deny posture only accepts traffic an explicit allow rule (netra_ebpf_netpol_rule_add) permits.
netra_intel_apply
Import the active threat-intel feed into deny maps. Requires mode=enforce with an active lease and confirm_risk=high. Optional matched_only imports only currently observed hits.
netra_intel_feed_get
Return the active threat-intel feed status and entries. Loading a feed (PUT) is a separate mutate tool.
netra_intel_feed_put
Replace the active threat-intel feed (JSON/CSV/bare list). Does not apply denies; use netra_intel_apply under an enforce lease.
netra_intel_hits
Match the active threat-intel feed against live agent metadata. Observe-only.
netra_intel_preview
Parse a threat-intel or deny list (JSON entries, CSV type,value,direction, or bare IPs/CIDRs/DNS names) into the shape POST /api/v1/ebpf/deny/import accepts. Applies nothing.
netra_policy_apply
Apply a CiliumNetworkPolicy manifest. Requires plan_token from a prior netra_policy_plan call on this exact manifest (tokens are single-use and expire after 5 minutes). If the plan's risk was "high" or "critical", confirm_risk must also be passed and must equal that risk level, or the call is rejected.
netra_policy_gitops_resync
Explicitly apply a candidate manifest via the GitOps pipeline, bypassing the reconciler's own auto-apply gating (drift or high/critical risk) — the human override for a manifest netra_policy_gitops_status shows as pending. If the computed risk is "high" or "critical", confirm_risk must be passed and must equal that risk level, or the call is rejected. 409 if GitOps is not enabled.
netra_policy_history_import
Import a previously exported policy revision archive (from netra_policies_history_export). mode="merge" (default) adds to existing history; mode="replace" discards existing history first and requires confirm_replace=true.
netra_policy_plan
Dry-run a CiliumNetworkPolicy manifest change against the live cluster and risk-assess it. Returns a receipt.token (valid 5 minutes, single use) that MUST be passed as plan_token to netra_policy_apply to actually apply this exact manifest. If plan.risk is "high" or "critical", netra_policy_apply also requires confirm_risk set to that same risk string.
netra_policy_simulate
Evaluate a candidate CiliumNetworkPolicy manifest's egress rules against the observed dependency graph and live workload labels — read-only, applies nothing. toCIDR/toCIDRSet/toEntities/toServices/toEndpoints destinations are precisely computed; toFQDNs destinations are always "unverified" (never a false "denied"), since there is no DNS/SNI→IP correlation to confirm or rule out a match.
netra_watchlist_match
Match an intel-grammar list against current flows/events/DNS/SNI. Applies nothing.

Show 1 more tools

unknown
Description is built at runtime.

Compare and alternatives

Featured in

Best MCP servers for observability

Signals

Stars: 5
Forks: 1
Open issues: 1
Last commit: Oct 20, 2026 (8 days ago)
Last release: Oct 19, 2026 (9 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name: io.github.zyvorai/netra
Version: 0.32.0
Auth: API key
Packages: oci ghcr.io/zyvorai/netra-mcp:0.32.0
License: License unknown
Repository: github.com/zyvorai/zyvor-netra
Website: github.com/zyvorai/zyvor-netra
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

More from zyvorai

Cite this page

Netra MCP server. Agent Mart. https://agentmart.dev/connectors/zyvorai-netra (last updated 2026-10-24)