research: MCPspy

[kemingy]

• core code: https://github.com/alex-ilgayev/MCPSpy/blob/main/bpf/mcpspy.c

---

• filter out pid of itself
• filter out non-pipe, non-json for vfs_read/vfs_write feat: support MCP #34
• filter out paths like /proc, /sys, /dev, /mnt, /memfd
• detect the HTTP protocol from the first several bytes chore(actions): Bump the all-actions group with 2 updates watchu#37
• only track local client request and remote server response Our assumption "read=>response" "write=request" may not hold #20