kubeshark/kubeshark
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard. observed · 2026-08-28
Health v2 · maintenance only
98/100
- Activity 99
- Release rhythm 97
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 13.0
- age_days: 1962
- days_rel: 20
- days_push: 8
- n_releases_24m: 37
Adoption not part of the score
12059 stars · 545 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
Kubeshark is an eBPF-powered network observability tool for Kubernetes that indexes cluster-wide L4/L7 traffic with full Kubernetes context and decrypts TLS/mTLS without keys or sidecars. It serves humans through a real-time dashboard and AI agents through MCP, enabling natural-language queries for incident response and root cause analysis.
Use cases
- capture and inspect cluster-wide network traffic in kubernetes
- decrypt tls traffic in kubernetes without keys or sidecars
- download retrospective pcap snapshots filtered by node, time, workload, or ip
- investigate api errors and root cause incidents with network data
- let ai agents query network traffic via mcp for security audits
- monitor tcp retransmissions and service error rates across the cluster
- debug microservice communication with full kubernetes identity on each connection
When to choose
- you run kubernetes and need wireshark-like deep packet visibility cluster-wide
- you need to see encrypted (TLS/mTLS) traffic in plain text without managing keys
- you want AI agents (Claude, Copilot) to reason over network traffic via MCP
- you need retrospective packet captures for incident response and compliance
When to avoid
- you are not running kubernetes — it is kubernetes-specific
- you only need metrics/logs tracing rather than full packet-level network data
- your cluster exceeds the free community tier limits (3 nodes / 60 pods) and you cannot pay
- you cannot run privileged eBPF instrumentation due to security policies
Facets
application · maturity active
monitoring tracing security mcp search-engine http-server cli monitoring networking security developer-tools artificial-intelligence windows go self-hosted cloud ebpf network-observability tls-decryption packet-capture pcap wireshark kubernetes incident-response root-cause-analysis sre ai-agents mcp grpc rest network-security cloud-native devops containers docker linux macos
6 sources
- readme: https://github.com/kubeshark/kubeshark · fetched 2026-08-28 · ed7b3287b115
- homepage: https://kubeshark.com · fetched 2026-08-29 · 29edc8540a50
- site_page: https://docs.kubeshark.com/en/install · fetched 2026-08-29 · 5fee0aaa38b4
- site_page: https://kubeshark.com/about · fetched 2026-08-29 · 099419f39991
- site_page: https://docs.kubeshark.com/ · fetched 2026-08-29 · 5493b9f86b86
- site_page: https://kubeshark.com/pricing · fetched 2026-08-29 · 309b152d836d
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| kubeshark/kubeshark | main | 98 |
For agents
markdown · JSON · MCP: product_card(name="kubeshark/kubeshark")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem