Kernel-level eBPF sandbox for securing LLM agent tool calls made through the Model Context Protocol (MCP)