# qpoint-io/qtap

Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes.

Repository: https://github.com/qpoint-io/qtap
Canonical: https://ross.abutalabs.com/products/qtap
Homepage: https://qpoint.io/products/qtap
Language: C
License: AGPL-3.0
License Family: copyleft
Topics: containers, developer-tools, ebpf, go, golang, kubernetes, libbpf, linux, observability, security
Last push: 2026-08-25T17:13:42+00:00

## Health v2 (maintenance only)
Score: 64/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 35, longevity 36
- inputs: {"age_days": 504, "days_push": 8, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1456, forks 56 (observed 2026-08-28T04:04:46.927222+00:00)

## What it is
Qtap is an eBPF agent that hooks TLS/SSL functions in the Linux kernel to capture network traffic before and after encryption, with full process, container, and protocol context. It provides visibility into egress traffic without proxies, certificate management, or application changes, feeding data to plugins and the QPoint platform.

## Use cases
- monitor external API calls and responses
- capture pre-encrypted network traffic with process context
- debug encrypted service communication
- audit egress traffic for compliance
- detect failed requests and errors in outbound traffic
- discover which processes make outbound connections
- track sensitive data leaving containers

## When to choose
- you need visibility into encrypted egress traffic without deploying proxies or sidecars
- you want to know which processes or containers are calling external APIs and what they send
- you run Kubernetes or Linux hosts and need out-of-band, low-overhead traffic introspection
- you need compliance auditing of encrypted communications

## When to avoid
- you need deep packet inspection of non-TLS or kernel-bypassed traffic
- you require a solution on non-Linux platforms
- you cannot run eBPF due to kernel version or privilege restrictions
- you want a fully open-source analytics stack - advanced features like alerting, RBAC, and sensitive data scanning are tied to the commercial QPoint platform

## Facets
- artifact type: service
- maturity: active
- function: monitoring, tracing, security, logging
- domain: security, monitoring, networking, developer-tools
- platform: self-hosted, cloud
- tags: ebpf, tls-visibility, egress-traffic, traffic-capture, observability, agent, network-inspection, devops, containers, linux, docker, kubernetes

## Member repositories
- qpoint-io/qtap (main) score 64

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:46.927222+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:35:37.370305+00:00, confidence not recorded.
  - readme: https://github.com/qpoint-io/qtap (fetched 2026-08-28T04:04:46.927222+00:00, sha 0f304dda60e7)
  - homepage: https://qpoint.io/products/qtap (fetched 2026-08-29T11:44:40.574623+00:00, sha fdb05f78e951)
  - site_page: https://qpoint.io/company/about-us (fetched 2026-08-29T11:44:40.605671+00:00, sha dcd94239d941)
  - site_page: https://qpoint.io/pricing (fetched 2026-08-29T11:44:40.607998+00:00, sha e5e7f8540d12)
  - site_page: https://qpoint.io/faq (fetched 2026-08-29T11:44:40.609737+00:00, sha f2db42f2a91a)
- Data as of 2026-08-30T08:39:29.467469+00:00.