kShield: An eBPF Runtime Defense Framework for Linux Kernel Privilege Escalation Attacks

Runtime defense for AI agents. 24 inline defenses, 3 output scanners, MCP server, framework adapters.

Wraith is a low-level Rust security sensor that answers a question most tools can't: "is this process being exploited right now?" By focusing entirely on anomalous runtime behavior rather than known signatures or payloads, Wraith detects live exploits and uncovers zero-day vulnerabilities completely in advance of a patch.