io.github.kubeshark/mcp
Real-time Kubernetes network traffic visibility and API analysis for HTTP, gRPC, Redis, Kafka, DNS.
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
https://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark-mcp_darwin_arm64.mcpbhttps://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark-mcp_darwin_amd64.mcpbhttps://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark-mcp_linux_arm64.mcpbhttps://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark-mcp_linux_amd64.mcpbhttps://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark-mcp_windows_amd64.mcpbDocumentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
Network Observability for SREs & AI Agents
Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.
What you can do:
- Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
- Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
- See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
- Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.
Get Started
helm repo add kubeshark https://helm.kubeshark.com
helm install kubeshark kubeshark/kubeshark
kubectl port-forward svc/kubeshark-front 8899:80Open http://localhost:8899 in your browser. You're capturing traffic.
For production use, we recommend using an ingress controller instead of port-forward.
Connect an AI agent via MCP:
brew install kubeshark
claude mcp add kubeshark -- kubeshark mcpNetwork Data for AI Agents
Kubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.
"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"
Works with Claude Code, Cursor, and any MCP-compatible AI.
AI Skills
Open-source, reusable skills that teach AI agents domain-specific workflows on top of Kubeshark's MCP tools:
| Skill | Description |
|---|---|
| Network RCA | Retrospective root cause analysis — snapshots, dissection, PCAP extraction, trend comparison |
| KFL | KFL (Kubeshark Filter Language) expert — writes, debugs, and optimizes traffic filters |
Install as a Claude Code plugin:
/plugin marketplace add kubeshark/kubeshark
/plugin install kubesharkOr clone and use directly — skills trigger automatically based on conversation context.
Query with API, Kubernetes, and Network Semantics
Kubeshark indexes cluster-wide network traffic by parsing it according to protocol specifications, with support for HTTP, gRPC, Redis, Kafka, DNS, and more. A single KFL query can combine all three semantic layers — Kubernetes identity, API context, and network attributes — to pinpoint exactly the traffic you need. No code instrumentation required.
KFL reference → · Traffic indexing →
Workload Dependency Map
A visual map of how workloads communicate, showing dependencies, traffic volume, and protocol usage across the cluster.
Traffic Retention & PCAP Export
Capture and retain raw network traffic cluster-wide, including decrypted TLS. Download PCAPs scoped by time range, nodes, workloads, and IPs — ready for Wireshark or any PCAP-compatible tool. Store snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.
Snapshots guide → · Cloud storage →
Features
| Feature | Description |
|---|---|
| **Traffic Snapshots** | Point-in-time snapshots with cloud storage (S3, Azure Blob, GCS), PCAP export for Wireshark |
| **Traffic Indexing** | Real-time and delayed L7 indexing with request/response matching and full payloads |
| **Protocol Support** | HTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more |
| **TLS Decryption** | eBPF-based decryption without key management, included in snapshots |
| **AI Integration** | MCP server + open-source AI skills for network RCA and traffic filtering |
| **KFL Query Language** | CEL-based query language with Kubernetes, API, and network semantics |
| **100% On-Premises** | Air-gapped support, no external dependencies |
Install
| Method | Command |
|---|---|
| Helm | helm repo add kubeshark https://helm.kubeshark.com && helm install kubeshark kubeshark/kubeshark |
| Homebrew | brew install kubeshark && kubeshark tap |
| Binary | Download |
Contributing
We welcome contributions. See CONTRIBUTING.md.
License
Frequently asked questions
What is io.github.kubeshark/mcp?
Real-time Kubernetes network traffic visibility and API analysis for HTTP, gRPC, Redis, Kafka, DNS.
How do I install io.github.kubeshark/mcp?
Follow the installation steps in its documentation, shown on this page and in its repository.
Does io.github.kubeshark/mcp need an API key?
Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.
Is io.github.kubeshark/mcp open source?
Yes. Its code is on GitHub under the Apache-2.0 license.
Who maintains io.github.kubeshark/mcp?
It is published by kubeshark. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.