kb mcp

kb-mcp — Model Context Protocol Host

Language: Go / Rust · Primary Maintainer: Tejaswini — Golang & API Pipelines · Collaborator: Pardhu Varma — Systems Integration

A standardized Model Context Protocol (MCP) server integration, exposing security analysis tools, telemetry resources, and custom prompts to external AI assistants, agent swarms, and workspace clients.

Architecture

The server operates as a thin mediation layer using JSON-RPC 2.0 over standard input/output (stdio) transport:

                 AI Assistant / IDE Client
                            │
                       MCP Client
                            │
              ─────────────────────────────
              │       KB MCP Server       │
              ─────────────────────────────
                │ (gRPC)             │ (Unix Socket)
          Go Control Plane       Rust/C kb-core
                │                    │
          Behavioral Engine   eBPF / LSM / Sensors

---

Exposed Tools

The server exposes the following functions to AI clients:

Tool Name	Parameters	Returns	Description
kb.get_process	pid: integer	Process profile JSON	Retrieves the behavioral profile and lineage of a process.
kb.list_anomalies	None	Sorted anomaly list	Returns active anomalies, ranked by risk score.
kb.query_events	filters: object	Event array	Searches the historical behavioral telemetry database.
kb.get_timeline	pid: integer	Chronological event list	Returns a timeline of process actions over time.
kb.get_risk	pid: integer	Risk score ($S_t$) & trend	Returns the current advisory risk score and state details.
kb.list_rules	None	Active rule array	Lists active behavioral detection rules.
kb.reload_rules	None	Success status	Reloads rule configurations from policy files.
kb.get_statistics	None	System metrics JSON	Returns global telemetry stats and eBPF map volumes.
kb.export_snapshot	None	Zip/JSON payload	Exports the current behavioral state of all processes.
kb.explain_alert	alert_id: string	Analysis report	Explains the rule matches that triggered a specific alert.
kb.quarantine_process	pid: integer, reason: string	Containment status	Restricts process execution using BPF LSM blocking.

---

Run & Compile

# Navigate to MCP directory
cd kb-op/kb-mcp

# Build the MCP server binary
go build -o kb-mcp main.go

# Start the host (requires stdio communications)
./kb-mcp

See also: Architecture, kb-control-plane, kb-tui.