kubeshark/kubeshark — EBPF-powered network observability for Kubernetes.

Description and use

**Brief Summary**
Kubeshark is an eBPF‑based network observability platform for Kubernetes that captures and indexes L4/L7 traffic with full Kubernetes context, even decrypting TLS streams without needing private keys. The data can be queried programmatically through the Model Context Protocol (MCP) for AI agents or interactively via a web dashboard, making it a bridge between AI assistants and real‑time cluster telemetry.

**Value**

• **AI‑ready telemetry**: By exposing traffic metadata through MCP, Kubeshark lets large language models or custom AI agents retrieve concrete, up‑to‑date network information, enabling automated troubleshooting, security analysis, and policy enforcement.
• **Full‑stack visibility**: eBPF collection provides low‑overhead, kernel‑level packet capture, while automatic TLS decryption and Kubernetes enrichment give a complete picture of service‑to‑service communication.
• **Unified access**: The same data source serves both human operators (dashboard, CLI, SDK) and machine agents, reducing the need for separate monitoring stacks.

**Practical Adoption Path**

1. **Deploy the Kubeshark Helm chart** (or the provided operator) into the target cluster; it runs as a DaemonSet with minimal resource impact.
2. **Configure MCP endpoints** to expose the indexed traffic to your AI platform or to a Model Context Protocol server you control.
3. **Integrate** your AI agents or automation scripts via the MCP client libraries (Go, Python, etc.), or use the built‑in dashboard/CLI for manual investigation.
4. **Iterate** by adding custom filters or enrichment rules (e.g., tag specific namespaces or services) to tailor the telemetry to your use cases.

**Production Readiness**

• **Active development**: Recent commits (as of 2026‑05‑13), a vibrant community (≈12 k stars, 537 forks), and regular releases indicate strong maintenance.
• **Mature ecosystem**: Written in Go, integrates cleanly with standard Kubernetes tooling (Helm, Operator SDK) and provides API/SDK/CLI interfaces.
• **Scalability & performance**: eBPF collection is proven low‑overhead; TLS decryption is done on‑the‑fly without storing keys, keeping security posture acceptable.
• **Adoption signals**: Multiple downstream projects already embed Kubeshark for observability and security, and the MCP interface is being used in early AI‑assistant pilots.

Overall, Kubeshark is production‑ready for organizations that need deep, AI‑accessible network insight in Kubernetes, with a straightforward deployment and integration path.

Problem

kubeshark/kubeshark helps connect AI assistants to real tools and data through a standard protocol.

Outcome

High for an OSS candidate: recent activity, adoption, and ecosystem signals are strong enough for a serious pilot.

Workflow

• connect AI agents to tools
• ship Model Context Protocol servers
• standardize integrations

Evidence

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

Source