Kubeshark MCP Server: Setup for Claude Desktop, Cursor and Other Apps

• Finds API requests seen in your cluster, filtered by status, path or pod

  Searches the HTTP, gRPC, Redis, Kafka and DNS calls Kubeshark has captured. You filter with Kubeshark's own query language, for example only responses with status 500.

  Try: “Show me all HTTP 500 errors in the last hour.”

  Read · list_api_calls

• Shows the full details of one captured API call

  Returns everything Kubeshark recorded about a single request and its response.

  Try: “Open the details of the failed checkout call you just found.”

  Read · get_api_call

• Summarises API traffic, such as counts and error rates

  Returns aggregated statistics over the captured API calls instead of single requests.

  Try: “Which endpoints have the most errors today?”

  Read · get_api_stats

• Lists the pods, services and namespaces that have network traffic

  Shows which workloads Kubeshark has seen talking on the network, so you know what you can ask about.

  Try: “Which services in the payments namespace have traffic right now?”

  Read · list_workloads

• Lists raw TCP and UDP connections between workloads

  Shows network flows at the connection level, with traffic statistics, and lets you filter by source or destination.

  Try: “What services are communicating with the database?”

  Read · list_l4_flows

• Summarises which workloads connect to which

  Returns a connectivity summary built from the TCP and UDP flows.

  Try: “Give me a map of who talks to whom in this cluster.”

  Read · get_l4_flow_summary

• Lists the saved network captures (PCAP snapshots)

  Shows the packet capture snapshots that already exist on the Kubeshark deployment.

  Try: “List the traffic snapshots we have.”

  Read · list_snapshots

• Saves a network capture of recent traffic

  Creates a new PCAP snapshot on the Kubeshark deployment so you can investigate an incident after the fact.

  Try: “Take a snapshot of the traffic from the last 10 minutes.”

  Write · create_snapshot

• Checks whether protocol parsing is running

  Reports whether Kubeshark is currently parsing application-level protocols from captured traffic.

  Try: “Is Kubeshark parsing HTTP traffic right now?”

  Read · get_dissection_status

• Turns on protocol parsing of captured traffic

  Switches on application-level protocol parsing on the Kubeshark deployment.

  Try: “Turn on protocol parsing for the latest snapshot.”

  Write · enable_dissection

• Turns off protocol parsing of captured traffic

  Switches off application-level protocol parsing on the Kubeshark deployment.

  Try: “Turn protocol parsing off to save resources.”

  Write · disable_dissection

• Exports a network capture as a PCAP file

  Prepares a snapshot for download as a PCAP file. The server's own instructions name this tool and say its result is fetched with the file tools below.

  Try: “Export the latest snapshot as a PCAP file.”

  Read · export_snapshot_pcap

• Checks whether Kubeshark is running and reachable

  Confirms Kubeshark is up. Marked read-only in the source.

  Try: “Is Kubeshark running in my cluster?”

  Read · check_kubeshark_status

• Turns an exported file path into a download link

  Resolves the relative path of an export into a full download address you can share.

  Try: “Give me the download link for that PCAP.”

  Read · get_file_url

• Saves an exported file to your computer

  Downloads a file such as a PCAP export to the local disk. The source confines downloads to a base folder.

  Try: “Download the PCAP export to my working folder.”

  Write · download_file

• Deploys Kubeshark into your cluster (only with the destructive flag)

  Runs the Kubeshark deploy command, which creates pods, services and other resources in the cluster. It is off unless you start the server with the destructive flag, and it does not work in URL mode.

  Try: “Deploy Kubeshark to my staging cluster.”

  Runs code · start_kubeshark

• Removes Kubeshark from your cluster (only with the destructive flag)

  Runs the Kubeshark clean command, which deletes its pods, services and resources, and the captured traffic data is lost. It is off unless you start the server with the destructive flag.

  Try: “Remove Kubeshark from the staging cluster.”

  Delete · stop_kubeshark

Watch out for

• Destructive flag lets it deploy and remove Kubeshark

  With the destructive flag, one tool deploys Kubeshark to the cluster and another deletes it along with captured data. Keep the flag off unless you need it. github.com

• It can read live traffic between your services

  Captured API calls can contain request data. Point it only at clusters where your assistant's provider may see that data. github.com

• It can change the Kubeshark setup

  It can create snapshots and switch protocol parsing on or off. Check the request before approving it on a shared deployment. github.com

• It can save files to your computer

  The download tool writes exported captures to a local folder. The source confines it to a base folder. github.com

Security advisories