Happy slice of mcp pizzaMCP.pizza
kubeshark

kubeshark

MCP.Pizza Chef: kubeshark

This tool watches all the network traffic moving between the pieces of a running Kubernetes application and makes it searchable in plain language. Ask your AI assistant why a checkout failed, which service is throwing errors, or how one request traveled through your system, and it can examine the actual traffic to answer. It can even read encrypted traffic without needing any keys. It works with Claude Code and Cursor, and requires a Kubernetes cluster with Kubeshark already installed — this is built for people who already run and manage a Kubernetes environment.

Coding
Data

Use This MCP server To

Ask why a specific request or checkout failed Find which services have unusually high error rates Trace one request as it moves through every service See encrypted traffic in plain text with no extra setup Download a slice of network traffic to investigate later Spot which services depend on each other Compare traffic patterns from before and after a deploy

README

Kubeshark

Release Docker pulls Discord Slack

Network Observability for SREs & AI Agents

Live Demo · Docs

Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.

What you can do:

  • Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
  • Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
  • See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
  • Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.

Kubeshark

Get Started

helm repo add kubeshark https://helm.kubeshark.com
helm install kubeshark kubeshark/kubeshark
kubectl port-forward svc/kubeshark-front 8899:80

Open http://localhost:8899 in your browser. You're capturing traffic.

For production use, we recommend using an ingress controller instead of port-forward.

Connect an AI agent via MCP:

brew install kubeshark
claude mcp add kubeshark -- kubeshark mcp

MCP setup guide →

Network Data for AI Agents

Kubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.

"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"

Works with Claude Code, Cursor, and any MCP-compatible AI.

kubeshark FAQ

Can I use this to figure out why a request or transaction failed?
Yes — ask your assistant about the failure and it can look at the actual network traffic around that time to find the cause.
Do I need a Kubernetes cluster to use this?
Yes. This tool runs inside a Kubernetes cluster and only makes sense if you already have one running with applications deployed on it.
Which AI apps does this work with?
It's built to work with Claude Code and Cursor, and it should connect to any AI assistant that supports MCP, including Claude Desktop and similar tools.
Do I need an account or an API key?
No account or API key is required to run it, but you do need access to install it on your own Kubernetes cluster.
How hard is it to set up?
Setup is technical — it involves installing Kubeshark on your cluster with Helm and connecting your AI assistant with a short command, so it's best suited for someone comfortable with Kubernetes.
Can I use this to see encrypted (HTTPS) traffic?
Yes — it can show encrypted traffic in readable form automatically, without you having to manage any certificates or keys.
Can I save traffic for later instead of only viewing it live?
Yes — you can capture and store slices of traffic filtered by time, service, or server, and download them for later review.
Does this only work for regular web (HTTP) traffic?
No — it understands many kinds of traffic, including HTTP, gRPC, Redis, Kafka, and DNS.