Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@kubeshark Why did checkout fail at 2:15 PM?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.
What you can do:
Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.
helm repo add kubeshark https://helm.kubeshark.com
helm install kubeshark kubeshark/kubeshark
kubectl port-forward svc/kubeshark-front 8899:80Open http://localhost:8899 in your browser. You're capturing traffic.
For production use, we recommend using an ingress controller instead of port-forward.
Connect an AI agent via MCP:
brew install kubeshark
claude mcp add kubeshark -- kubeshark mcpKubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.
"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"
Works with Claude Code, Cursor, and any MCP-compatible AI.
Open-source, reusable skills that teach AI agents domain-specific workflows on top of Kubeshark's MCP tools:
Skill | Description |
Retrospective root cause analysis — snapshots, dissection, PCAP extraction, trend comparison | |
KFL (Kubeshark Filter Language) expert — writes, debugs, and optimizes traffic filters |
Install as a Claude Code plugin:
/plugin marketplace add kubeshark/kubeshark
/plugin install kubesharkOr clone and use directly — skills trigger automatically based on conversation context.
Kubeshark indexes cluster-wide network traffic by parsing it according to protocol specifications, with support for HTTP, gRPC, Redis, Kafka, DNS, and more. A single KFL query can combine all three semantic layers — Kubernetes identity, API context, and network attributes — to pinpoint exactly the traffic you need. No code instrumentation required.
KFL reference → · Traffic indexing →
A visual map of how workloads communicate, showing dependencies, traffic volume, and protocol usage across the cluster.
Capture and retain raw network traffic cluster-wide, including decrypted TLS. Download PCAPs scoped by time range, nodes, workloads, and IPs — ready for Wireshark or any PCAP-compatible tool. Store snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.
Snapshots guide → · Cloud storage →
Related MCP server: PCAP-Analyzer MCP Server
Feature | Description |
Point-in-time snapshots with cloud storage (S3, Azure Blob, GCS), PCAP export for Wireshark | |
Real-time and delayed L7 indexing with request/response matching and full payloads | |
HTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more | |
eBPF-based decryption without key management, included in snapshots | |
MCP server + open-source AI skills for network RCA and traffic filtering | |
CEL-based query language with Kubernetes, API, and network semantics | |
Air-gapped support, no external dependencies |
Method | Command |
Helm |
|
Homebrew |
|
Binary |
We welcome contributions. See CONTRIBUTING.md.
This server cannot be deployed
AI agent observability for production traces, natural-language insights, and improvement loops.
MCP observability. Query live traffic, errors, duration, and alerts from your AI agent.
Privacy-first product analytics. Your agent sets up tracking and answers questions about traffic.
Data + AI observability — monitor and troubleshoot production-grade agents and the context they use.
