Kubeshark

io.github.kubeshark由 GitHub 账号 kubeshark 发布v53.6.0更新于 Oct 26, 2026

Real-time Kubernetes network traffic visibility and API analysis for HTTP, gRPC, Redis, Kafka, DNS.

已验证STDIO仅桌面云端与基础设施安全与监控数据与分析

概览

AI 生成的概览

Kubeshark MCP 让 AI 助手获取整个 Kubernetes 集群的网络流量数据，用于查询 API、排查故障和根因分析。

可以做什么
  • 用结合 Kubernetes 身份、API 上下文和网络属性的 KFL 查询过滤集群范围的网络流量
  • 调查 API 调用并跨服务追踪请求，包括错误率和 TCP 重传趋势
  • 按时间范围、节点、工作负载和 IP 下载回溯性 PCAP，供 Wireshark 等工具使用
  • 处理 HTTP、gRPC、GraphQL、Redis、Kafka、DNS 等已索引的 L7 流量，包括解密后的 TLS 负载
  • 配合开源 AI 技能进行网络根因分析和流量过滤器的编写与调试
适用场景
当助手需要回答关于 Kubernetes 实时或近期网络流量的问题时适用，例如某时刻结账为何失败、哪些服务错误率超过阈值、某个请求如何流经各服务。适合已在集群中部署 Kubeshark 的 SRE 与故障响应场景。
运行要求
作为本地进程运行在用户机器上（仅桌面端），可通过 Homebrew 或对应平台的安装包安装，并连接到集群中的 Kubeshark 部署。集群侧需用 Helm 或二进制安装，通常通过端口转发或 ingress 访问。未声明任何认证、环境变量或请求头。
安装前请注意
Kubeshark 在内核层捕获并索引整个集群的流量，并解密 TLS/mTLS，因此敏感负载和凭据可能暴露给助手，并被存入快照或云存储（S3、Azure Blob、GCS）。下载 PCAP 和保留快照会把数据写到集群之外，启用前应审查访问与保留策略。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Kubeshark，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

[Kubeshark]

[Release] [Docker pulls] [Discord] [Slack]

Network Observability for SREs & AI Agents

Live Demo · Docs

Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.

What you can do:

  • Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
  • Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
  • See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
  • Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.

[Kubeshark]

Get Started

bash
helm repo add kubeshark https://helm.kubeshark.comhelm install kubeshark kubeshark/kubesharkkubectl port-forward svc/kubeshark-front 8899:80

Open http://localhost:8899 in your browser. You're capturing traffic.

For production use, we recommend using an ingress controller instead of port-forward.

Connect an AI agent via MCP:

bash
brew install kubesharkclaude mcp add kubeshark -- kubeshark mcp

MCP setup guide →

Network Data for AI Agents

Kubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.

"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"

Works with Claude Code, Cursor, and any MCP-compatible AI.

[MCP Demo]

MCP setup guide →

AI Skills

Open-source, reusable skills that teach AI agents domain-specific workflows on top of Kubeshark's MCP tools:

SkillDescription
Network RCARetrospective root cause analysis — snapshots, dissection, PCAP extraction, trend comparison
KFLKFL (Kubeshark Filter Language) expert — writes, debugs, and optimizes traffic filters

Install as a Claude Code plugin:

/plugin marketplace add kubeshark/kubeshark/plugin install kubeshark

Or clone and use directly — skills trigger automatically based on conversation context.

AI Skills docs →

Query with API, Kubernetes, and Network Semantics

Kubeshark indexes cluster-wide network traffic by parsing it according to protocol specifications, with support for HTTP, gRPC, Redis, Kafka, DNS, and more. A single KFL query can combine all three semantic layers — Kubernetes identity, API context, and network attributes — to pinpoint exactly the traffic you need. No code instrumentation required.

[KFL query combining API, Kubernetes, and network semantics]

KFL reference → · Traffic indexing →

Workload Dependency Map

A visual map of how workloads communicate, showing dependencies, traffic volume, and protocol usage across the cluster.

[Service Map]

Learn more →

Traffic Retention & PCAP Export

Capture and retain raw network traffic cluster-wide, including decrypted TLS. Download PCAPs scoped by time range, nodes, workloads, and IPs — ready for Wireshark or any PCAP-compatible tool. Store snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.

[Traffic Retention]

Snapshots guide → · Cloud storage →

Features

FeatureDescription
Traffic SnapshotsPoint-in-time snapshots with cloud storage (S3, Azure Blob, GCS), PCAP export for Wireshark
Traffic IndexingReal-time and delayed L7 indexing with request/response matching and full payloads
Protocol SupportHTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more
TLS DecryptioneBPF-based decryption without key management, included in snapshots
AI IntegrationMCP server + open-source AI skills for network RCA and traffic filtering
KFL Query LanguageCEL-based query language with Kubernetes, API, and network semantics
100% On-PremisesAir-gapped support, no external dependencies

Install

MethodCommand
Helmhelm repo add kubeshark https://helm.kubeshark.com && helm install kubeshark kubeshark/kubeshark
Homebrewbrew install kubeshark && kubeshark tap
BinaryDownload

Installation guide →

Contributing

We welcome contributions. See CONTRIBUTING.md.

License

Apache-2.0

来源：README.md，提交 35e484c

工具

0
SourceWeft 曾在隔离沙箱中以无凭据方式启动该软件包一次，以列出其工具，但未能完成：该软件包类型无法在沙箱中运行。

版本历史

3
  1. v53.6.0最新Oct 21, 2026
  2. v53.5.0Oct 7, 2026
  3. v53.4.0Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分