rafiimam /

agent-capture-bench

Ground-truth benchmark for process capture on Linux: an independent eBPF oracle scores tracers, audit pipelines, and agent recorders against what the kernel actually executed

A new way for AI to search for data
View on GitHub
1GitHub stars
14commits on main
0forks

Python 65.6%, C 31.2%, Shell 1.6%, Makefile 1.5% · created 2026-10-16 · last push 2026-10-20

What XERJ indexed

Snapshot

29 files · 113.6 KB

The whole repository at commit d0c7f4952b (2026-10-20). main is 6 commits ahead.

Selected work

Rafi Imam
@rafiimam

“capture-evasion scenario suite, execsnoop+auditd adapters, macO…”. 9 files, 548 lines in workflow, adapters, tests.

Licence

The repository

MIT

LICENSE file checked at the pinned commit; the author agreed to inclusion.

The XERJ corpus

MIT, with credit

The author agreed by email on 2026-10-26. Same terms as the repository. Answers name the repo, the commit and the file:line.

selected for the XERJ Corpus Hublicence clearedsuggested use: adapt with attribution

agent-auditingauditbenchmarkbpfebpfkernellinuxobservability

Example questions

The prompt

Paste it into your AI agent. It clones rafiimam/agent-capture-bench at the pinned commit and indexes it on your machine.

Search the GitHub repository rafiimam/agent-capture-bench with XERJ (https://hub.xerj.org/corpus/rafiimam--agent-capture-bench).
Run these in a shell, in order, and check each result before the next:
1. xerj --help  (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh
2. git clone https://github.com/rafiimam/agent-capture-bench agent-capture-bench && git -C agent-capture-bench checkout d0c7f4952bab4a7418398d3e529dd19cd68f4c36
3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data
4. xerj autoindex ./agent-capture-bench --url http://127.0.0.1:9200 --prefix agent-capture-bench --progress plain
5. xerj autoindex map --url http://127.0.0.1:9200
Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt
Licence: MIT. Keep the copyright notice and credit the authors.

Related

Rafi ImamOperations and SRE corporacorootxobotyi--cc-foundry-backendjaeger-docsgma1k/podtraceValkyrieSentinel/nox-guardbpftrace/bpftrace

Stats: GitHub API, fetched 2026-10-31. Snapshot: the git tree at the pinned commit. Selected work and consent: the XERJ registry.