What is mcpfz-probe?

This is a security testing companion tool. It works alongside a separate project called mcp-server-fuzzer, which is a tool that automatically tests MCP servers, the services AI assistants call out to, by sending them unexpected or malformed inputs to look for bugs and security holes. While that fuzzer handles starting the process being tested and timing each call, this project watches what actually happens on the computer while each call runs, and connects those observed events back to the specific call that caused them. It is split into two parts. A small Rust program, called the sidecar, does the actual low level watching, since Rust is well suited for a small, easily checked, high performance program. A Python library handles coordinating with the fuzzer and deciding whether an observed event counts as a problem. The watching itself works two ways. A simple fake mode replays a scripted set of events for testing purposes, requiring no special system permissions and running on any operating system. A real mode, available only on Linux, uses a kernel technology called eBPF to directly observe system calls such as starting a new program, opening a network connection, opening or deleting a file, or attaching a debugger to a process. This real mode has been tested against a deliberately vulnerable example server and successfully caught it running shell commands, reading sensitive files, connecting out over the network, and manipulating files, attributing each of these actions to the exact tool call that triggered it. Developers using the two tools together turn this monitoring on with a few environment variables, and the fuzzer's final report then includes these kernel level findings alongside its usual results. The project includes both Python and Rust test suites and documentation covering its communication protocol and internal architecture.