It attaches uprobes to OpenSSL's SSL_write/SSL_read to capture decrypted payloads, classifies traffic to 12+ LLM providers (OpenAI, Anthropic, Google, etc.), detects MCP JSON-RPC calls, and can block connections in-kernel via LSM hooks.
You can write inline Rego policies for enforcement. For example, deny any request to Anthropic containing a specific keyword:
sudo busted monitor --enforce --rule 'package busted default decision = "allow" decision = "deny" { input.llm_provider == "Anthropic" contains(input.tls_payload, "secret_project") }' Everything is Rust — eBPF programs, userspace agent, classifier, policy engine, and native egui dashboard. Built with Aya.