MCP as Observability Interface: When agents start reading the kernel

Three signals that can’t be ignored

It has been reported that Datadog shipped an MCP Server connecting dashboards and metrics to AI agents — a big vendor giving a small protocol a huge vote of confidence. It has been reported that Cloud Native Now ran a piece on eBPF for Kubernetes network observability, showing how kernel-level telemetry can expose drop reasons and reveal problems nobody planned for. Qualys allegedly warned that MCP servers are “the new shadow IT for AI,” finding that over 53% of deployments rely on static secrets and urging better logging and anomaly detection. Put those three together and a picture emerges: agents want direct access to infrastructure telemetry, and MCP is the plumbing they’re using.

Two paths forward

There are two sensible architectures here. The first is the wrapper model: stick MCP atop an existing observability stack (Datadog’s play). Agents query pre-shaped, indexed views — great for trends and SLO checks. The second is MCP-native: make the MCP server the observability layer itself, surfacing raw kernel tracepoints and event streams directly to agents. That’s what the Ingero team did with an eBPF-based tracer for CUDA APIs, piping raw events into SQLite and exposing them via MCP tools. Different tools for different jobs. Want a p99? Use the wrapper. Hunting down why one request blew up by 14.5x? You’ll want raw traces.

A fast, human moment

Here’s the bit that grabs you: in a vLLM regression case the MCP-native tracer captured every CUDA call, context switch, and memory op. It has been reported that when an LLM agent (Claude) loaded that trace it produced causal chains, ran SQL on raw events, and identified the root cause in under 30 seconds. Fast, clean, and a little bit thrilling — like watching Sherlock solve a case from footprints only a dog would notice. That speed changes expectations: agents aren’t just automating rote tasks anymore, they’re becoming the first responders to infrastructure mysteries.

So what now?

If MCP becomes the standard interface between agents and telemetry, observability tooling will bifurcate: platforms that summarize and platforms that hand over the raw logs and tracepoints. Security teams, rightly, should be nervous — shadow IT for AI is a real problem. But operators hungry for better root-cause work will cheer. The real question: do we build more adapters, or do we let MCP be the platform? The choice will shape how we debug systems in the age of autonomous agents.

Sources: ingero.io, Hacker News