Netra
OCI · GHCR.IO/ZYVORAI/NETRA-MCP
eBPF network observability and safe emergency control for Linux and Kubernetes.
Available components
Last scanned (8 hours ago)
Scores higher than 49% of OCI servers
Category Monitoring and Observability
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: this image's dependency list comes from an SBOM its publisher attached, which nothing verifies, so we will not report it as a clean result.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this image's dependency list comes from an SBOM its publisher attached. It names packages and versions but not whether each is deprecated, still maintained or linked to its source, so there is nothing we can fairly grade.Unverified
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 9769 tokens (~66/item across 147 items; 138 tools + 9 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "netra_ebpf_drops" implies "drop" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 139 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Oct 26 +1
- Tool safety: pass → unverified ▼ security
- Stability: 0.10 → unverified ▼ security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.31.0 → 0.32.0 functional
- 17 Oct 26 +1
- Stability: unverified → 0.07 ▲ functional
- Package version: 0.30.1 → 0.31.0 functional
- 15 Oct 26 35
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 19 Oct 2026 · Analysed oci/ghcr.io/zyvorai/netra-mcp@0.32.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
netra_agents ~29
List all reporting Netra agents (one per node) with their latest status and staleness.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ai_agent ~157
Run the in-process natural-language graph: classify the question, optionally preview a deny/rate/allow draft, then synthesize a brief. Same snapshot and read-only contract as netra_ai_ask. Returns a step trace. Never applies rules.
| Name | Type | Req | Description |
|---|---|---|---|
| conversationId | string | – | Optional. Web/ChatOps multi-turn id; leave empty from MCP — the calling agent already has its own memory. |
| namespace | string | – | Optional namespace hint included in the answer context. |
| preferLlm | boolean | – | Hint only; the controller uses the configured provider when a key is set. |
| question | string | yes | Operator question, e.g. "why is DNS failing in kube-system?" or "deny dns malware.example". |
No output schema declared.
No examples provided.
netra_ai_ask ~108
Ask a natural-language question about the current Netra snapshot. Answers from aggregates only. Optional LLM rewrite when NETRA_AI_API_KEY is set on the controller. Never mutates.
| Name | Type | Req | Description |
|---|---|---|---|
| namespace | string | – | Optional namespace hint included in the answer context. |
| preferLlm | boolean | – | Hint only; the controller uses the configured provider when a key is set. |
| question | string | yes | Operator question, e.g. "why is DNS failing in kube-system?". |
No output schema declared.
No examples provided.
netra_ai_brief ~36
Deterministic cluster network brief built from live agent/health/insights aggregates. No packet payloads. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ai_digest ~34
On-call digest: severity, incident fingerprint, copy-paste card. Fingerprint stays stable while only raw counters chatter.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ai_draft ~82
Parse a natural-language deny/rate request into a preview eBPF rule. Never applies. Review the body/CLI then use a mutating tool only if the operator explicitly wants it.
| Name | Type | Req | Description |
|---|---|---|---|
| question | string | yes | e.g. "deny dns malware.example" or "rate limit 1.2.3.4 to 100 pps". |
No output schema declared.
No examples provided.
netra_ai_explain ~115
Narrate one structured finding (kind/subject/message/page) against the live snapshot. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Finding kind, e.g. dns-failure or kfree_skb. |
| message | string | – | Original finding text. |
| page | string | – | Dashboard page the finding came from: health, drops, insights. |
| question | string | – | Optional override question. |
| severity | string | – | info|warning|critical. |
| subject | string | – | Workload or node subject. |
No output schema declared.
No examples provided.
netra_ai_status ~41
Whether the optional LLM rewrite path is configured. Heuristic briefs always work; an API key is required only for prose rewrite. AI endpoints never mutate.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ai_suggestions ~31
Live follow-up questions derived from the current snapshot (stale agents, DNS, exposure, lease).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_audit ~65
List recent Netra audit events: every mutating action taken through the controller API, including by this MCP server, with actor/action/target.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max events to return, 1-500 (server caps at 500). Default 100. |
No output schema declared.
No examples provided.
netra_audit_summary ~74
Rollup of the audit log by actor, action, and hour. Observe-only.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max audit events to aggregate, 1-1000. Default 500. |
| since | string | – | RFC3339 lower bound. |
| until | string | – | RFC3339 upper bound. |
No output schema declared.
No examples provided.
netra_baselines ~23
Whether behavior and rate baselines exist and how old they are.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_capture_status ~40
Every node with an active packet-capture session: filter, snap length, requestor, start/expiry time. Does not return captured packets themselves.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_capture_summaries ~67
Bounded metadata for active and recent capture sessions (frame counts, protocol buckets, duration). Never returns packet payloads or PCAP bytes — use the Capture UI for live frames.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max history rows, 1-500. Default 50. |
No output schema declared.
No examples provided.
netra_compliance ~33
CIS-inspired network hardening pack from sysctl-audit. Review-only; Netra never writes sysctls.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_dns_board ~40
DNS names ranked by failure count from agent DNS health stats.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max rows, 1-200. Default 30. |
No output schema declared.
No examples provided.
netra_drops_explain ~99
Unified explain-a-drop findings: Netra's own standalone-eBPF Drop Detective findings (always present) plus Hubble/Cilium findings when Hubble is configured. Each finding's source field distinguishes netra from hubble.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max dropped flows to explain, 1-100. Default 20. |
| namespace | string | – | Filter by namespace. |
| pod | string | – | Filter by pod name. |
No output schema declared.
No examples provided.
netra_ebpf_ai_destinations ~40
Observe known GenAI/MCP SaaS destinations via SNI/HTTP Host/DNS metadata. No payloads. Applies nothing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_app_categories ~34
Heuristic CDN/SaaS/cloud category labels from SNI/Host/DNS metadata. Not DPI.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_attachments ~74
Read-only BPF attachment inventory and hook drift per node. Lists what the kernel reports; never attaches, detaches, or replaces a program, and never touches Cilium-owned programs or maps. Fix missing Netra hooks by restarting the agent.
| Name | Type | Req | Description |
|---|---|---|---|
| node | string | – | Limit to one node name. |
No output schema declared.
No examples provided.
netra_ebpf_auto_mitigate ~36
Status of optional volumetric auto-mitigation (conn-rate / Shield / leased deny). Observe-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_auto_mitigate_preview ~53
Shadow preview of volumetric auto-mitigate candidates from current scan findings and UDP deltas. Applies nothing. Metric anomalies never feed this path. Live actions still need an enforce lease.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_capabilities ~42
Static manifest of this Netra deployment's eBPF hooks, observability signals, and enforcement capabilities, including per-rule-type map capacity limits.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_capdrift ~107
Capability-change anomalies (effective-capability gain/loss) on processes the eBPF datapath already tracks — agent-sourced from a periodic /proc scan (requires NETRA_PROCMETA_ENABLED on the agent), not a live kernel credential read. Includes a capdrift-coverage-gap finding when an agent restarted recently, since its in-memory diff state resets on restart.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-200. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_census ~28
Counts of deny/allow list entries. Does not return the entries themselves.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_config ~64
The live eBPF fast-path configuration (mode, all blocked IPs/CIDRs/ports/UIDs/DNS/processes/SNI, rate limits, workload scopes).
| Name | Type | Req | Description |
|---|---|---|---|
| node | string | – | Also include the current workload inventory for this node. |
No output schema declared.
No examples provided.
netra_ebpf_coverage ~34
Per-node hook/program coverage matrix: attached vs detached programs, missing maps, stale agents. Observe-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_deny_preview ~227
Review-only blast radius for a proposed emergency deny. Matches live non-stale agent flow counters, connect-attempt, DNS, TLS SNI, or sampled process events. Applies nothing, writes nothing, does not flip enforce mode. Absence of a hit is not proof the destination is unused.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | Packet direction to match. Default both. |
| kind | string | yes | Deny kind to preview. |
| limit | integer | – | Max hits to return, 1-200. Default 50. |
| namespace | string | – | Optional workload namespace filter. |
| pod | string | – | Optional pod name filter. |
| port | integer | – | Optional destination port for kind=port when value is not the port. |
| protocol | string | – | Optional L4 protocol filter for ip/cidr/port. |
| value | string | yes | IP, CIDR, port number, DNS name, SNI, or process comm. |
| workloadKind | string | – | Optional owner kind filter. |
| workloadName | string | – | Optional owner name filter. |
No output schema declared.
No examples provided.
netra_ebpf_deny_preview_history ~256
Review-only historical blast radius for a proposed emergency deny against the controller flowlog (up to 7 days). Uses counterfactual evaluation over retained flow deltas. Applies nothing. Prefer live netra_ebpf_deny_preview for process matches and current counters; DNS/SNI often empty on historical rows.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | Packet direction to match. Default both. |
| kind | string | yes | Deny kind to preview. |
| limit | integer | – | Max flow deltas to evaluate, up to 100000. Default 2000. |
| namespace | string | – | Optional workload namespace filter. |
| pod | string | – | Optional pod name filter. |
| port | integer | – | Optional destination port for kind=port when value is not the port. |
| protocol | string | – | Optional L4 protocol filter for port. |
| since | string | – | Lookback window: duration (default 1h, max 168h) or RFC3339 start. |
| value | string | yes | IP, CIDR, port number, DNS name, or SNI. |
| workloadKind | string | – | Optional owner kind filter. |
| workloadName | string | – | Optional owner name filter. |
No output schema declared.
No examples provided.
netra_ebpf_diagnose ~48
Drop-detective findings: likely root causes for observed drops, correlated with the current fast-path config.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max findings. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_dns_findings ~98
Metadata-only DNS anomaly findings (tunneling, DGA, beaconing, NXDOMAIN/SERVFAIL storms) from a continuously-running detector fed by matched DNS-response events. Observe-only; a miss does not prove a domain is benign. Returns 409 if NETRA_DNSDETECT_ENABLED is not set. Distinct from netra_dns_board, which is per-name query/failure counters, not behavioral detection.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_drops ~44
Drop diagnostics aggregated from kernel skb drop-reason counters across agents.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-500. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_encrypted_dns ~35
DoT (port 853) and known DoH SaaS destinations from metadata. No decryption.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_exehash ~112
Executable-content-hash-change anomalies on processes the eBPF datapath already tracks — a live process's on-disk binary content changing while it runs. Observe-only half of exe-hash leased deny; agent-sourced from the same periodic /proc scan capability-drift uses (requires NETRA_PROCMETA_ENABLED). Includes an exehash-coverage-gap finding when an agent restarted recently.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-200. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_health ~51
Network health diagnostics and anomalies derived from agent reports (TCP health, retransmits, connect latency, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-200. Default 20. |
No output schema declared.
No examples provided.
netra_ebpf_interfaces ~75
Per-interface flow attribution: packets/bytes/blocked and top destinations per network interface, from Netra's TC/TCX-attached hooks only (not cgroup or XDP-early-deny traffic).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max top destinations per interface, 1-200. Default 10. |
No output schema declared.
No examples provided.
netra_ebpf_ipv6 ~57
IPv6 extension-header and fragmentation diagnostics: extension-header counts, fragmentation rate, and truncated-chain counts per node, with anomaly detection.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-500. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_l7 ~66
Best-effort L7 observability: TLS SNI, cleartext HTTP/1 method+Host, and HTTP/1 status when the status line starts the packet.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-1000. Default 100. |
No output schema declared.
No examples provided.
netra_ebpf_maps ~67
Read-only inventory of datapath map contents (controller desired state under /sys/fs/bpf/netra): deny/allow/rate/policy entries with human labels, counts, and limits. Not a raw bpftool dump. See docs/ebpf-maps.md.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_nsdrift ~98
Network-namespace-change anomalies on processes the eBPF datapath already tracks — a live process moving network namespaces after start (setns), agent-sourced from the same periodic /proc scan capability-drift uses (requires NETRA_PROCMETA_ENABLED). Includes an nsdrift-coverage-gap finding when an agent restarted recently.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-200. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_path ~45
Path diagnostics: per-hop/per-hook health signals for traffic across the cluster.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-500. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_reasons ~27
Histogram of FastPathEvent action/reason pairs. No payloads.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_rules_get ~43
Get one eBPF fast-path rule by its stable ID.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Rule ID from netra_ebpf_rules_list. |
No output schema declared.
No examples provided.
netra_ebpf_rules_history ~93
Revision history for one eBPF fast-path rule's edits (via netra_ebpf_rules_patch), each with a before/after snapshot. Rule creation/deletion remain visible via netra_audit instead.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Rule ID from netra_ebpf_rules_list. |
| limit | integer | – | Max revisions to return, 1-200. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_rules_list ~76
List every eBPF fast-path deny rule (exact IP, CIDR, port, UID, process, DNS, SNI, rate limit) with its stable ID, so it can be referenced by netra_ebpf_rules_patch/_delete/_history instead of the legacy value-keyed add/delete tools.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_scan_findings ~90
Port-scan, fan-out, lateral-movement, and SYN-flood findings from a continuously-running detector fed by per-connection-attempt TCP flag data. Allowed (non-blocked) traffic is only sampled by the datapath, so absence of a finding is not proof a workload made no such attempts. Returns 409 if NETRA_SCANDETECT_ENABLED is not set.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
netra_ebpf_scope_preview ~74
Preview which pods would match a set of eBPF workload scopes, without changing the active scope (see netra_ebpf_scope_set to apply).
| Name | Type | Req | Description |
|---|---|---|---|
| scopes | array | yes | Workload scopes to test. Each may specify namespace/pod/workloadKind/workloadName/labels/cgroupId. |
No output schema declared.
No examples provided.
netra_ebpf_shield ~74
XDP Shield diagnostics: allowed/dropped/audited traffic broken out by class (SYN/UDP/ICMP/other) per node, plus the top offending sources across the cluster, with anomaly detection.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items, 1-500. Default 50. |
No output schema declared.
No examples provided.
netra_ebpf_stack_histograms ~57
Observe-only softirq/softnet pressure and listen-queue depth buckets from agent reports. Not entry→exit softirq latency. Never changes tunables.
| Name | Type | Req | Description |
|---|---|---|---|
| node | string | – | Limit to one node name. |
No output schema declared.
No examples provided.
netra_ebpf_summary ~28
A high-level rollup of eBPF fast-path activity across all agents.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Netra MCP server?
Netra runs locally as a container image, launched with docker run --rm -i -e NETRA_URL -e NETRA_API_KEY -e NETRA_MCP_ALLOW_MUTATIONS -e NETRA_MCP_ACTOR ghcr.io/zyvorai/netra-mcp:0.32.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/zyvorai/netra-mcp
claude mcp add zyvorai-netra -- docker run --rm -i -e NETRA_URL -e NETRA_API_KEY -e NETRA_MCP_ALLOW_MUTATIONS -e NETRA_MCP_ACTOR ghcr.io/zyvorai/netra-mcp:0.32.0
This image reads NETRA_URL, NETRA_API_KEY, NETRA_MCP_ALLOW_MUTATIONS and NETRA_MCP_ACTOR. Set them in your client's env block for this server; docker run -e passes each one through to the container.
What is the Netra MCP server?
Netra is an MCP server listed in the public MCP registry as io.github.zyvorai/netra. eBPF network observability and safe emergency control for Linux and Kubernetes. This page covers its container image (ghcr.io/zyvorai/netra-mcp).
Is the Netra MCP server safe to use?
Netra scores 37 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Netra MCP server expose?
Netra exposes 138 tools: netra_agents, netra_ai_agent, netra_ai_ask, netra_ai_brief, netra_ai_digest, and 133 more. Their descriptions and schemas cost roughly 9,562 tokens of context every time the server is loaded.
Is the Netra MCP server still maintained?
Netra is still listed as active in the MCP registry. We last reached this channel on 19 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Netra MCP server under?
Netra declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.