Kubeshark
io.github.kubesharkPublished by GitHub account kubesharkv53.6.0Updated Oct 26, 2026
Real-time Kubernetes network traffic visibility and API analysis for HTTP, gRPC, Redis, Kafka, DNS.
Overview
Kubeshark MCP gives an AI assistant cluster-wide Kubernetes network traffic data for querying APIs, investigating incidents and root cause analysis.
- What you can do
- Query cluster-wide network traffic using KFL filters that combine Kubernetes identity, API context and network attributes
- Investigate API calls and trace requests across services, including error rates and TCP retransmission trends
- Download retrospective PCAPs scoped by time range, nodes, workloads and IPs for Wireshark or other tools
- Work with indexed L7 traffic for HTTP, gRPC, GraphQL, Redis, Kafka and DNS, including decrypted TLS payloads
- Use open-source AI skills for network root cause analysis and writing or debugging traffic filters
- When to use it
- Useful when an assistant needs to answer questions about live or recent Kubernetes network traffic, such as why a checkout failed at a given time, which services exceed an error-rate threshold, or how a request moved through services. Suited to SRE and incident-response workflows on a cluster already running Kubeshark.
- Requirements
- Runs as a local process on the user's machine (desktop only), installed via Homebrew or a platform-specific package, and connects to a Kubeshark deployment in the cluster. The cluster side is installed with Helm or a binary and typically reached through a port-forward or ingress. No authentication, environment variables or headers are declared.
Installation
In SourceWeft
- Open Kubeshark in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
[Release] [Docker pulls] [Discord] [Slack]
Network Observability for SREs & AI Agents
Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.
What you can do:
- Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
- Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
- See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
- Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.
Get Started
Open http://localhost:8899 in your browser. You're capturing traffic.
For production use, we recommend using an ingress controller instead of port-forward.
Connect an AI agent via MCP:
Network Data for AI Agents
Kubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.
"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"
Works with Claude Code, Cursor, and any MCP-compatible AI.
AI Skills
Open-source, reusable skills that teach AI agents domain-specific workflows on top of Kubeshark's MCP tools:
Install as a Claude Code plugin:
Or clone and use directly — skills trigger automatically based on conversation context.
Query with API, Kubernetes, and Network Semantics
Kubeshark indexes cluster-wide network traffic by parsing it according to protocol specifications, with support for HTTP, gRPC, Redis, Kafka, DNS, and more. A single KFL query can combine all three semantic layers — Kubernetes identity, API context, and network attributes — to pinpoint exactly the traffic you need. No code instrumentation required.
[KFL query combining API, Kubernetes, and network semantics]
KFL reference → · Traffic indexing →
Workload Dependency Map
A visual map of how workloads communicate, showing dependencies, traffic volume, and protocol usage across the cluster.
Traffic Retention & PCAP Export
Capture and retain raw network traffic cluster-wide, including decrypted TLS. Download PCAPs scoped by time range, nodes, workloads, and IPs — ready for Wireshark or any PCAP-compatible tool. Store snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.
Snapshots guide → · Cloud storage →
Features
Install
Contributing
We welcome contributions. See CONTRIBUTING.md.
License
Source: README.md at commit 35e484c
Tools
0Version history
3- v53.6.0LatestOct 21, 2026
- v53.5.0Oct 7, 2026
- v53.4.0Sep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts