Repositories list

• sigwire

  Public
  tail -f for signals. Every signal any process on the box raises — who sent it, who it hit, which signal, how it was raised (kill(2), the kernel, a POSIX timer),…

  linuxipclogs+ 4

  linuxipclogsshowcasesignalssystemstail

  JavaScript

  •22 forks•116116 stars•00 issues•00 pull requests•Updated Jul 13, 2026Jul 13, 2026

• sqlitefeed

  Public
  tail -f for SQLite. Every statement any process on the box runs against libsqlite3 — the SQL (syntax-highlighted), the values bound to its ? placeholders, the p…

  sqliteshowcasesqlite3+ 2

  sqliteshowcasesqlite3ebpfuprobe

  JavaScript

  •11 fork•99 stars•11 issue•22 pull requests•Updated Jul 10, 2026Jul 10, 2026

• md-sentry

  Public
  eBPF integrity monitor for an LLM agent's markdown brain: CLAUDE.md, skills, memory. Tags AGENT vs EXTERNAL edits.

  linuxsecuritykernel+ 11

  linuxsecuritykernelshowcaseprovenanceintegrityebpfobservabilitybpffile-monitoring+ 4

  JavaScript

  •00 forks•11 star•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• runfrom

  Public
  Live exec-provenance monitor. Flags execs from tmp/shm, fileless binaries, and setuid privilege jumps, all in-kernel.

  linuxsecuritykernel+ 12

  linuxsecuritykernelshowcaseprovenancetracingebpfexecobservabilitysetuid+ 5

  JavaScript

  •00 forks•11 star•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• dialout

  Public
  Every outbound TCP connection, captured in-kernel and grouped by the process that dialed it. Flags public egress.

  linuxsecuritynetworking+ 11

  linuxsecuritynetworkingkerneltcpshowcasetracingebpfobservabilitybpf+ 4

  JavaScript

  •00 forks•22 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• netwatch

  Public
  Network throughput as an 80s sunset. A two-sided bar chart of live traffic over time — egress (TX) climbing up from a neon zero-axis, ingress (RX) falling down,…

  networkingneoningress+ 4

  networkingneoningressshowcasetuiretrowaveegress

  JavaScript

  •00 forks•1111 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• container-explorer

  Public

  yeet-src/container-explorer’s past year of commit activity
  docker ps that you can actually walk around in. Every running container on the host as a live table — arrow into any one and get a full, self-refreshing inspect…

  javascriptdockertools+ 3

  javascriptdockertoolscontainersshowcasedevops-tools

  JavaScript

  •22 forks•6666 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• knicks-pbp

  Public
  Your CPU called play-by-play from the Garden — a live system monitor skinned as a Knicks game (system-load-as-basketball). Fan-made; not live NBA data.

  showcase

  showcase

  JavaScript

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• knicks-scoreboard

  Public

  yeet-src/knicks-scoreboard’s past year of commit activity
  Live Linux system monitor skinned as a Madison Square Garden scoreboard: CPU as the score, top processes as the box score. htop, but it's a Knicks game.

  linuxcputerminal+ 11

  linuxcputerminalmonitoringdashboardbasketballshowcasetuiprocessesscoreboard+ 4

  JavaScript

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• heatsink

  Public
  Live hwmon temperatures, throttle headroom, GPU draw and per-core clocks in one terminal dashboard. htop for thermals.

  linuxterminalmonitoring+ 11

  linuxterminalmonitoringdashboardgpushowcasetuitemperaturesensorsobservability+ 4

  JavaScript

  •00 forks•22 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• container-traffic

  Public
  Live per-container HTTP dashboard read from the kernel with eBPF. Rate, errors, latency. No sidecar, no app changes.

  linuxdockerhttp+ 12

  linuxdockerhttpkernelcontainersshowcasetuicgroupsebpfobservability+ 5

  JavaScript

  •00 forks•66 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• agent-jail

  Public
  Confine an AI coding agent (oh-my-pi/omp) to one directory with Landlock, and watch it live over eBPF. Experimental.

  securitysandboxshowcase+ 6

  securitysandboxshowcaseebpfai-agentsyeetlandlockllm-toolsoh-my-pi

  JavaScript

  •00 forks•44 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• grpcsnoop

  Public
  tcpdump for gRPC. Decodes protobuf messages between services live, from the kernel. Plaintext only.

  linuxdebuggingnetworking+ 13

  linuxdebuggingnetworkingkernelprotobufcontainershttp2grpcshowcasetracing+ 6

  JavaScript

  •

  GNU General Public License v2.0

  •00 forks•22 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• tui-paint

  Public
  A tiny MS-Paint for your terminal. A full-screen canvas you draw on with the mouse — brush, flood-fill, eraser, a ten-swatch palette, undo/redo — every cell pai…

  artdrawingpaint+ 5

  artdrawingpaintinteractivepixelshowcasetuiyeet

  JavaScript

  •00 forks•33 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• redissnoop

  Public
  Live, zero-config Redis traffic profiler built on eBPF. Reads plaintext and TLS, no app changes.

  showcase

  showcase

  JavaScript

  •22 forks•2525 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• agent-lock

  Public
  Confine an AI agent (Claude Code, Codex, oh-my-pi, ...) to one directory with a BPF-LSM program, and watch it live over eBPF.

  linuxsecuritysandbox+ 9

  linuxsecuritysandboxshowcaseebpfai-agentslsmyeetllm-toolsagent-security+ 2

  JavaScript

  •

  GNU General Public License v2.0

  •55 forks•3636 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• httpinspect

  Public
  top, but for the HTTP endpoints on your host — a live dashboard of the most active plaintext HTTP endpoints, right in the terminal.

  javascripthttpinteractive+ 4

  javascripthttpinteractiveshowcasetuiebpfobservability

  JavaScript

  •1414 forks•219219 stars•00 issues•22 pull requests•Updated Jul 10, 2026Jul 10, 2026

• claudefeed

  Public
  Live audit log of every command, file, and network connection a Claude Code (or any matched) session makes, from the kernel.

  linuxsecuritykernel+ 12

  linuxsecuritykernelshowcaseauditprovenancetracingebpfobservabilitybpf+ 5

  C

  •00 forks•1414 stars•00 issues•33 pull requests•Updated Jul 10, 2026Jul 10, 2026

• script-template

  Public
  C

  •00 forks•11 star•00 issues•22 pull requests•Updated Jul 1, 2026Jul 1, 2026

• toolchain

  Public
  Static, version-pinned build toolchain for yeet scripts

  toolchainllvmclang+ 2

  toolchainllvmclangebpfyeet

  C

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jun 23, 2026Jun 23, 2026

• flowball

  Public
  JavaScript

  •00 forks•11 star•00 issues•00 pull requests•Updated Jun 18, 2026Jun 18, 2026

• doom

  Public
  C

  •

  GNU General Public License v2.0

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jun 17, 2026Jun 17, 2026

• .github

  Public
  00 forks•00 stars•00 issues•00 pull requests•Updated Jun 12, 2026Jun 12, 2026

• terraform-aws-yeet-ec2-termination-handler

  Public
  HCL

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jun 10, 2026Jun 10, 2026

• httpbody

  Public
  JavaScript

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jun 3, 2026Jun 3, 2026

• claudetree

  Public
  JavaScript

  •00 forks•00 stars•00 issues•00 pull requests•Updated Jun 1, 2026Jun 1, 2026

• poolnarc

  Public
  Behavioral hidden-cryptominer detector for Linux in eBPF — flags processes talking to mining-pool ports while spoofing kernel-thread names. No signatures, no ag…

  showcase

  showcase

  JavaScript

  •00 forks•44 stars•00 issues•00 pull requests•Updated Jun 1, 2026Jun 1, 2026

• usbsnoop

  Public
  Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware snif…

  linuxusbreverse-engineering+ 9

  linuxusbreverse-engineeringshowcasetracingebpfobservabilitybpfyeetlibbpf+ 2

  JavaScript

  •55 forks•8484 stars•00 issues•00 pull requests•Updated May 31, 2026May 31, 2026

• ciprof

  Public
  JavaScript

  •00 forks•00 stars•00 issues•11 pull request•Updated May 29, 2026May 29, 2026

• ifacesnoop

  Public
  JavaScript

  •00 forks•00 stars•00 issues•00 pull requests•Updated May 29, 2026May 29, 2026