Kubeshark

- Query L7 API transactions with KFL filters— uselist_api_callsto find HTTP, gRPC, Redis, Kafka, or DNS requests matching conditions like status codes or paths.
- Inspect a specific API call in detail— retrieve full request/response data for a single transaction withget_api_call.
- Get aggregated API statistics— summarize traffic patterns, error rates, or latency distributions usingget_api_stats.
- View L4 network flows and summaries— list TCP/UDP connections and get connectivity overviews vialist_l4_flowsandget_l4_flow_summary.
- Create and manage PCAP snapshots— capture network traffic for offline analysis withcreate_snapshotandlist_snapshots.
- Control L7 protocol dissection— enable or disable deep protocol parsing on demand usingenable_dissectionanddisable_dissection.

KubesharkMCP (Model Context Protocol) server enables AI assistants like Claude Desktop, Cursor, and other MCP-compatible clients to query real-time Kubernetes network traffic.

The MCP provides the tools —AI skillsteach agents how to use them. Skills turn raw MCP capabilities into domain-specific workflows like root cause analysis, traffic filtering, and forensic investigation. See theskills READMEfor installation and usage.

# macOS brew install kubeshark # Linux sh <(curl -Ls https://kubeshark.com/install) # Windows (PowerShell) choco install kubeshark

{ "mcpServers": { "kubeshark": { "command": "kubeshark", "args": ["mcp"] } } }

{ "mcpServers": { "kubeshark": { "command": "kubeshark", "args": ["mcp", "--kubeconfig", "/path/to/.kube/config"] } } }

Use this when the machine doesn't have kubectl access or a kube context. Connect directly to an existing Kubeshark deployment:

{ "mcpServers": { "kubeshark": { "command": "kubeshark", "args": ["mcp", "--url", "https://kubeshark.example.com"] } } }

For agated Hub(AUTH_ENABLED=true), URL mode can't mint a token (no kube access), so supply one explicitly via--token(or theKUBESHARK_HUB_TOKENenv var). Mint it from a machine that has cluster access:

kubectl create token kubeshark-cli -n <release-namespace> --audience kubeshark-hub

{ "mcpServers": { "kubeshark": { "command": "kubeshark", "args": ["mcp", "--url", "https://kubeshark.example.com", "--token", "<token>"] } } }

The token is short-lived (~1h) and URL modecannot auto-renewit; when it expires the server reports a clear401 ... token expired/invalidmessage — re-mint and restart. Proxy mode (default, with kube access) mints thekubeshark-clitoken automatically andauto-renewsit, so long-running sessions don't expire.

{ "mcpServers": { "kubeshark": { "command": "kubeshark", "args": ["mcp", "--allow-destructive", "--kubeconfig", "/path/to/.kube/config"] } } }

kubeshark mcp --mcp-config --url https://kubeshark.example.com

User: Show me all HTTP 500 errors in the last hour Claude: I'll query the API traffic for 500 errors. [Calling list_api_calls with kfl="http and response.status == 500"] Found 12 HTTP 500 errors: 1. POST /api/checkout -> payment-service (500) Time: 10:23:45 | Latency: 2340ms ...

User: What services are communicating with the database? Claude: Let me check the L4 flows to the database. [Calling list_l4_flows with dst_filter="postgres"] Found 5 services connecting to postgres:5432: - orders-service: 456KB transferred - users-service: 123KB transferred ...

# HTTP requests to a specific path http and request.path == "/api/users" # Errors only response.status >= 400 # Specific source pod src.pod.name == "frontend-.*" # Multiple conditions http and src.namespace == "default" and response.status == 500

Kubeshark is published to theMCP Registryautomatically on each release.

Theserver.jsonin this directory is a reference file. The actual registry metadata (version, SHA256 hashes) is auto-generated during the release workflow. See.github/workflows/release.ymlfor details.

- Documentation
- GitHub
- Website
- MCP Registry

Retrieves essential network information from devices using gNMI and OpenConfig models.