Kubeshark

Community Security & Testing 12k likes

Kubeshark gives AI agents queryable access to cluster-wide Kubernetes network traffic, captured and TLS-decrypted at the kernel level via eBPF.

Add to Claude Code

claude mcp add kubeshark -- kubeshark mcp

Source: https://github.com/kubeshark/kubeshark

About

Kubeshark captures and indexes network traffic across an entire Kubernetes cluster using eBPF, decrypting TLS without needing certificates or key material and reconstructing L7 protocols — HTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more — with full Kubernetes context (pod, namespace, workload) attached to every packet. None of this requires instrumenting or restarting the workloads being observed.

Its MCP server puts that traffic store behind natural-language queries: an agent can ask about API calls, TCP-level behavior, or take point-in-time snapshots for later PCAP export and root-cause analysis, filtered through Kubeshark's CEL-based KFL query language that understands both Kubernetes identity and network attributes. Kubeshark also publishes two companion AI skills — one for retrospective root-cause analysis with snapshot comparison, and one for writing and optimizing KFL queries — meant to be used alongside the MCP server in Claude Code, Cursor, or other MCP clients.

Key features

eBPF-based TLS decryption with no key management required
Reconstructs L7 protocols: HTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more
KFL query language combines CEL filtering with Kubernetes and network context
Point-in-time traffic snapshots exportable as PCAP, with cloud storage support (S3, Azure Blob, GCS)
Workload dependency mapping to visualize service-to-service communication
Companion skills for root-cause analysis and KFL query writing shipped alongside the MCP server

Use cases

Ask an agent to explain why a specific service's API calls started failing using live cluster traffic
Generate a KFL query to isolate traffic between two namespaces without knowing the syntax by heart
Pull a traffic snapshot around an incident window and hand it to an agent for root-cause analysis
Investigate whether a service is calling an unexpected external endpoint, using natural-language questions

Available tools

Snapshot capture & export

Takes point-in-time PCAP snapshots of cluster traffic and exports them for offline analysis.

L7 API querying

Queries reconstructed application-layer calls (HTTP, gRPC, GraphQL, Kafka, etc.) via KFL.

L4 traffic flow querying

Queries raw TCP-level flow and connection data across the cluster.

TCP expert insights

Surfaces protocol-level diagnostic findings (retransmits, resets, latency issues) from captured flows.

Frequently asked questions

Does Kubeshark need my services' TLS keys to decrypt traffic?

No — it uses eBPF to decrypt TLS traffic at the kernel level without requiring certificates or key material from the workloads being observed.

Do I need to restart my pods to start capturing their traffic?

No — Kubeshark observes traffic passively via eBPF, so no instrumentation or restart of the target workloads is required.