kubeshark/mcp/server.json

{
  "$schema": "https://registry.modelcontextprotocol.io/schemas/server.schema.json",
  "name": "com.kubeshark/mcp",
  "displayName": "Kubeshark",
  "description": "Real-time Kubernetes network traffic visibility and API analysis. Query L7 API transactions (HTTP, gRPC, Redis, Kafka, DNS), L4 network flows, and manage Kubeshark deployments directly from AI assistants.",
  "icon": "https://kubeshark.com/favicon.ico",
  "repository": {
    "url": "https://github.com/kubeshark/kubeshark",
    "source": "github"
  },
  "homepage": "https://kubeshark.com",
  "license": "Apache-2.0",
  "version": "52.12.0",
  "authors": [
    {
      "name": "Kubeshark",
      "url": "https://kubeshark.com"
    }
  ],
  "categories": [
    "kubernetes",
    "networking",
    "observability",
    "debugging",
    "security"
  ],
  "tags": [
    "kubernetes",
    "network",
    "traffic",
    "api",
    "http",
    "grpc",
    "kafka",
    "redis",
    "dns",
    "pcap",
    "wireshark",
    "tcpdump",
    "observability",
    "debugging",
    "microservices"
  ],
  "packages": [
    {
      "registryType": "github-releases",
      "name": "kubeshark/kubeshark",
      "version": "52.12.0",
      "runtime": "binary",
      "platforms": [
        "darwin-arm64",
        "darwin-amd64",
        "linux-arm64",
        "linux-amd64",
        "windows-amd64"
      ],
      "transport": {
        "type": "stdio",
        "command": "kubeshark",
        "args": ["mcp"]
      }
    }
  ],
  "tools": [
    {
      "name": "check_kubeshark_status",
      "description": "Check if Kubeshark is currently running in the cluster. Read-only operation.",
      "mode": "proxy"
    },
    {
      "name": "start_kubeshark",
      "description": "Deploy Kubeshark to the Kubernetes cluster. Requires --allow-destructive flag.",
      "mode": "proxy",
      "destructive": true
    },
    {
      "name": "stop_kubeshark",
      "description": "Remove Kubeshark from the Kubernetes cluster. Requires --allow-destructive flag.",
      "mode": "proxy",
      "destructive": true
    },
    {
      "name": "list_workloads",
      "description": "List pods, services, namespaces, and nodes with observed L7 traffic.",
      "mode": "all"
    },
    {
      "name": "list_api_calls",
      "description": "Query L7 API transactions (HTTP, gRPC, Redis, Kafka, DNS) with KFL filtering.",
      "mode": "all"
    },
    {
      "name": "get_api_call",
      "description": "Get detailed information about a specific API call including headers and body.",
      "mode": "all"
    },
    {
      "name": "get_api_stats",
      "description": "Get aggregated API statistics and metrics.",
      "mode": "all"
    },
    {
      "name": "list_l4_flows",
      "description": "List L4 (TCP/UDP) network flows with traffic statistics.",
      "mode": "all"
    },
    {
      "name": "get_l4_flow_summary",
      "description": "Get L4 connectivity summary including top talkers and cross-namespace traffic.",
      "mode": "all"
    },
    {
      "name": "list_snapshots",
      "description": "List all PCAP snapshots.",
      "mode": "all"
    },
    {
      "name": "create_snapshot",
      "description": "Create a new PCAP snapshot of captured traffic.",
      "mode": "all"
    },
    {
      "name": "get_dissection_status",
      "description": "Check L7 protocol parsing status.",
      "mode": "all"
    },
    {
      "name": "enable_dissection",
      "description": "Enable L7 protocol dissection.",
      "mode": "all"
    },
    {
      "name": "disable_dissection",
      "description": "Disable L7 protocol dissection.",
      "mode": "all"
    }
  ],
  "prompts": [
    {
      "name": "analyze_traffic",
      "description": "Analyze API traffic patterns and identify issues"
    },
    {
      "name": "find_errors",
      "description": "Find and summarize API errors and failures"
    },
    {
      "name": "trace_request",
      "description": "Trace a request path through microservices"
    },
    {
      "name": "show_topology",
      "description": "Show service communication topology"
    },
    {
      "name": "latency_analysis",
      "description": "Analyze latency patterns and identify slow endpoints"
    },
    {
      "name": "security_audit",
      "description": "Audit traffic for security concerns"
    },
    {
      "name": "compare_traffic",
      "description": "Compare traffic patterns between time periods"
    },
    {
      "name": "debug_connection",
      "description": "Debug connectivity issues between services"
    }
  ],
  "configuration": {
    "properties": {
      "url": {
        "type": "string",
        "description": "Direct URL to Kubeshark Hub (e.g., https://kubeshark.example.com). When set, connects directly without kubectl/proxy.",
        "examples": ["https://kubeshark.example.com", "http://localhost:8899"]
      },
      "kubeconfig": {
        "type": "string",
        "description": "Path to kubeconfig file for proxy mode.",
        "examples": ["~/.kube/config", "/path/to/.kube/config"]
      },
      "allow-destructive": {
        "type": "boolean",
        "description": "Enable destructive operations (start_kubeshark, stop_kubeshark). Default: false for safety.",
        "default": false
      }
    }
  },
  "modes": {
    "url": {
      "description": "Connect directly to an existing Kubeshark deployment via URL. Cluster management tools are disabled.",
      "args": ["mcp", "--url", "${url}"]
    },
    "proxy": {
      "description": "Connect via kubectl port-forward. Requires kubeconfig access to the cluster.",
      "args": ["mcp", "--kubeconfig", "${kubeconfig}"]
    },
    "proxy-destructive": {
      "description": "Proxy mode with destructive operations enabled.",
      "args": ["mcp", "--kubeconfig", "${kubeconfig}", "--allow-destructive"]
    }
  }
}