Qpoint's qtap reads TLS plaintext via eBPF without a proxy

Security auditing, API debugging and integration work all keep hitting the same wall: traffic is TLS-encrypted, so finding out what an application really sends usually means standing up a man-in-the-middle proxy, installing certificates, reconfiguring every client, and accepting latency on a path you have now altered.

Qtap, from observability company Qpoint, attacks the problem where encryption actually happens. Its eBPF agent scans each process's binaries and libraries for TLS symbols and hooks SSL_read and SSL_write with user-space probes, capturing the data in its original unencrypted form and attaching the context a proxy never sees: process, container, host, user and protocol. Statically linked programs are handled by probing the binary directly, and the maintainers explained on the launch thread that Go binaries are covered by precomputed per-version structure offsets plus an ELF scanner.

The payoff is inspection with no instrumentation: no application changes, no proxy, no certificate management, and a claim of out-of-band operation with minimal overhead. The project launched on Hacker News in May 2025 to 259 points and 78 comments, and by catalogue time the Apache-2.0 repository showed 1.5k stars and 289 commits, with Qpoint building its egress observability offerings on the same agent.

Read the plaintext where encryption starts, not where traffic passes

Hooking SSL_read and SSL_write puts the observer exactly where plaintext exists, so nothing needs to be decrypted on the wire.

No proxy and no certificates mean legacy systems, third-party binaries and short-lived processes can be inspected without touching them.

The kernel's view carries process, container, host and user context, which a network-level proxy cannot attribute.

Because traffic is observed rather than rerouted, the application's own connection path and latency are unchanged.

Open-sourcing the agent with a demo mode let the community probe the approach, which is how the Go-binary question surfaced and was answered in public.

Encrypted traffic is plaintext at the boundary where it is produced; intercept it there with kernel-level visibility, and you can inspect applications without modifying a single one of them.

By the time the batch catalogued the project, qtap showed 1.5k stars and 289 commits under the Apache 2.0 license, with the authors still calling it early development. The repository ships a Chrome DevTools-style web interface, OpenTelemetry trace and metrics endpoints, a sample Grafana dashboard, and one-command demo and install scripts, and the company behind it, Qpoint, builds inventory and alerting products for egress traffic on the same agent.