Verified project record

kubeshark/kubeshark

Kubeshark captures and indexes cluster-wide Kubernetes network traffic at the kernel level using eBPF, providing deep visibility without requiring code instrumentation. It includes built-in TLS decryption and an MCP server to enable AI agents to investigate API calls and perform network root cause analysis.

Project overview

Project type: MCP · AI Agent · Infrastructure
Deployment: Refer to project documentation
License: Apache-2.0

Best for

Operations teams and developers who need to perform root cause analysis on Kubernetes network traffic without modifying application code.
AI engineers looking to enable agent-driven network investigations using an MCP server and open-source AI skills.
Organizations requiring local-only data boundaries can deploy this tool on-premises with no external dependencies.

Key capabilities

Captures and indexes cluster-wide network traffic at the kernel level using eBPF with no code instrumentation required.
Decrypts TLS/mTLS traffic using eBPF without requiring key management or sidecars.
A CEL-based query language that combines Kubernetes identity, API context, and network attributes to pinpoint specific traffic.
Exposes cluster-wide network data via MCP so AI agents can query traffic, investigate API calls, and perform root cause analysis.
Reusable skills that teach AI agents domain-specific workflows on top of the MCP tools, such as Network RCA and KFL.
Downloads packet captures filtered by nodes, time, workloads, and IPs for long-term retention and later investigation.
A visual map showing how workloads communicate, including dependencies, traffic volume, and protocol usage across the cluster.
Stores traffic snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.

Limitations and risks

Requires eBPF support and specific kernel capabilities on the host, which may restrict usage on older operating systems or restricted environments.

Getting started

Use copy-pasteable shell commands to add the Helm repository, install the chart, and port-forward the service to access the web GUI immediately.

Evidence and sources

GitHub project description: eBPF-powered network observability for Kubernetes.
README: Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.
README: Network Observability for SREs & AI Agents
README: Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs.
README: No code instrumentation required.

Reviewed at: 2026-07-18T01:36:54Z