← Back to directory

Kubeshark

Official

Kubernetes network observability for SREs and AI agents

GitHub source repository ↗

★ 12.0k Stars Category · Other Very popular

52FMRS · D

Reliability

9/20

Security and permissions

8/20

Maintenance

11/20

Documentation

12/20

Setup experience

12/20

Kubeshark is an official MCP server maintained by Kubeshark for Kubernetes network observability, debugging, incident response, and AI-assisted root-cause analysis. It uses stdio and supports direct URL and kubeconfig proxy modes. Key considerations are cluster access, destructive deployment and removal operations, and sensitive-data exposure from decrypted traffic and full payloads.

Read the FMRS scoring method →

Kubeshark is an eBPF-powered MCP server for Kubernetes network observability. It indexes cluster-wide L4/L7 traffic with Kubernetes, API, and network semantics, and analyzes protocols including HTTP, gRPC, Redis, Kafka, and DNS. It supports querying API calls, network flows, metrics, and PCAP snapshots, and can decrypt TLS/mTLS traffic without key management or sidecars.

Tools

check_kubeshark_status

Check whether Kubeshark is currently running in the cluster; read-only.

start_kubeshark

Deploy Kubeshark to the Kubernetes cluster; requires --allow-destructive.

stop_kubeshark

Remove Kubeshark from the Kubernetes cluster; requires --allow-destructive.

list_workloads

List pods, services, namespaces, and nodes with observed L7 traffic.

list_api_calls

Query L7 API transactions for HTTP, gRPC, Redis, Kafka, and DNS using KFL filters.

get_api_call

Get detailed information about a specific API call, including headers and body.

get_api_stats

Get aggregated API statistics and metrics.

list_l4_flows

List L4 TCP/UDP network flows with traffic statistics.

get_l4_flow_summary

Get an L4 connectivity summary, including top talkers and cross-namespace traffic.

list_snapshots

List all PCAP snapshots.

create_snapshot

Create a new PCAP snapshot of captured traffic.

get_dissection_status

Check L7 protocol parsing status.

enable_dissection

Enable L7 protocol dissection.

disable_dissection

Disable L7 protocol dissection.

Setup

Install and deploy Kubeshark with: helm repo add kubeshark https://helm.kubeshark.com && helm install kubeshark kubeshark/kubeshark. Then optionally run kubectl port-forward svc/kubeshark-front 8899:80 and open http://localhost:8899. To connect an AI agent, run brew install kubeshark followed by claude mcp add kubeshark -- kubeshark mcp. You can also connect directly to an existing Kubeshark Hub with the url setting, or use proxy mode with a kubeconfig file.

Fit and risk

Best for

SRE, DevOps, and network engineering teams using Kubernetes.
Incident response and root-cause analysis requiring cluster-wide network, API, and Kubernetes context.
Teams that want MCP-compatible AI agents to query live or retained network data.

Not for

Users who do not run Kubernetes or do not need network traffic observability.
Client scenarios requiring only generic file, database, or collaboration features.
Environments where handling sensitive traffic or decrypting TLS/mTLS is unacceptable.

Required permissions

Proxy mode requires a kubeconfig with access to the Kubernetes cluster.
Direct URL mode requires access to an existing Kubeshark Hub URL.
Start and stop operations require explicitly enabling --allow-destructive.
The source does not specify exact Kubernetes RBAC permissions or authentication mechanisms.

Risks and side effects

The server can deploy or remove Kubeshark; start_kubeshark and stop_kubeshark are marked destructive.
Observed data may include complete API requests, headers, bodies, and PCAPs.
TLS/mTLS traffic can be decrypted into plaintext, potentially exposing sensitive information.
The source does not specify access-control, authentication, or data-retention policies.

Troubleshooting

Call check_kubeshark_status first to confirm that Kubeshark is running in the cluster.
In proxy mode, verify the kubeconfig path and cluster access.
In direct mode, verify that the Kubeshark Hub URL is reachable.
For the local dashboard, confirm that kubectl port-forward svc/kubeshark-front 8899:80 is running.
Check get_dissection_status and enable or disable L7 dissection as needed.
Confirm that --allow-destructive has not been enabled without authorization.

Use cases

Query API traffic and analyze errors, failures, and latency.

Trace requests through microservices.

View service communication topology and workload dependencies.

Analyze TCP/UDP connectivity, cross-namespace traffic, and top talkers.

Create or query PCAP snapshots for incident response and root-cause analysis.

Audit traffic for security concerns.

Supported clients

Claude CodeFull support

CursorPartial support

Related MCP servers

Compare with other MCP servers