# kubeshark/kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

Repository: https://github.com/kubeshark/kubeshark
Canonical: https://ross.abutalabs.com/products/kubeshark
Homepage: https://kubeshark.com
Language: Go
License: Apache-2.0
License Family: permissive
Topics: kubernetes, golang, rest, grpc, devops, sniffer, observability, wireshark, cloud-native, docker, incident-response, ebpf, mcp, network-analysis, network-engineering, network-observability, network-security, pcap, root-cause-analysis, sre
Last push: 2026-08-25T06:18:46+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 97, longevity 100
- inputs: {"age_days": 1962, "days_push": 8, "days_rel": 20, "gap_med": 13.0, "n_releases_24m": 37}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 12059, forks 545 (observed 2026-08-28T04:10:51.636760+00:00)

## What it is
Kubeshark is an eBPF-powered network observability tool for Kubernetes that indexes cluster-wide L4/L7 traffic with full Kubernetes context and decrypts TLS/mTLS without keys or sidecars. It serves humans through a real-time dashboard and AI agents through MCP, enabling natural-language queries for incident response and root cause analysis.

## Use cases
- capture and inspect cluster-wide network traffic in kubernetes
- decrypt tls traffic in kubernetes without keys or sidecars
- download retrospective pcap snapshots filtered by node, time, workload, or ip
- investigate api errors and root cause incidents with network data
- let ai agents query network traffic via mcp for security audits
- monitor tcp retransmissions and service error rates across the cluster
- debug microservice communication with full kubernetes identity on each connection

## When to choose
- you run kubernetes and need wireshark-like deep packet visibility cluster-wide
- you need to see encrypted (TLS/mTLS) traffic in plain text without managing keys
- you want AI agents (Claude, Copilot) to reason over network traffic via MCP
- you need retrospective packet captures for incident response and compliance

## When to avoid
- you are not running kubernetes — it is kubernetes-specific
- you only need metrics/logs tracing rather than full packet-level network data
- your cluster exceeds the free community tier limits (3 nodes / 60 pods) and you cannot pay
- you cannot run privileged eBPF instrumentation due to security policies

## Facets
- artifact type: application
- maturity: active
- function: monitoring, tracing, security, mcp, search-engine, http-server, cli
- domain: monitoring, networking, security, developer-tools, artificial-intelligence
- platform: windows, go, self-hosted, cloud
- tags: ebpf, network-observability, tls-decryption, packet-capture, pcap, wireshark, kubernetes, incident-response, root-cause-analysis, sre, ai-agents, mcp, grpc, rest, network-security, cloud-native, devops, containers, docker, linux, macos

## Member repositories
- kubeshark/kubeshark (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:51.636760+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:14:58.186618+00:00, confidence not recorded.
  - readme: https://github.com/kubeshark/kubeshark (fetched 2026-08-28T04:10:51.636760+00:00, sha ed7b3287b115)
  - homepage: https://kubeshark.com (fetched 2026-08-29T08:12:31.536836+00:00, sha 29edc8540a50)
  - site_page: https://docs.kubeshark.com/en/install (fetched 2026-08-29T08:12:31.539672+00:00, sha 5fee0aaa38b4)
  - site_page: https://kubeshark.com/about (fetched 2026-08-29T08:12:31.543167+00:00, sha 099419f39991)
  - site_page: https://docs.kubeshark.com/ (fetched 2026-08-29T08:12:31.544873+00:00, sha 5493b9f86b86)
  - site_page: https://kubeshark.com/pricing (fetched 2026-08-29T08:12:31.541539+00:00, sha 309b152d836d)
- Data as of 2026-08-30T08:39:29.467469+00:00.