MCP Server Command for AI Assistant Integration

Author: alongirCreated Feb 3, 2026Updated Apr 27, 2026

MCP Server Command for AI Assistant Integration

The kubeshark mcp command runs an MCP (Model Context Protocol) server over stdio, enabling AI assistants like Claude Desktop, Cursor, and other MCP-compatible clients to query Kubeshark's L7/L4 network visibility.

Quick Start

bash

# List available tools from a running Kubeshark instance
kubeshark mcp --list-tools --url https://kubeshark.example.com

# Generate Claude Desktop configuration
kubeshark mcp --mcp-config --url https://kubeshark.example.com

Configuration

URL Mode (Recommended)

Connect directly to an existing Kubeshark deployment:

json

{
  "mcpServers": {
    "kubeshark": {
      "command": "/path/to/kubeshark",
      "args": ["mcp", "--url", "https://kubeshark.example.com"]
    }
  }
}

Proxy Mode

When no --url is provided, the CLI proxies into the cluster using kubectl:

json

{
  "mcpServers": {
    "kubeshark": {
      "command": "/path/to/kubeshark",
      "args": ["mcp", "--kubeconfig", "/path/to/.kube/config"]
    }
  }
}

Enabling Destructive Operations

By default, destructive operations (start_kubeshark, stop_kubeshark) are disabled for safety. To enable them:

json

{
  "mcpServers": {
    "kubeshark": {
      "command": "/path/to/kubeshark",
      "args": ["mcp", "--allow-destructive", "--kubeconfig", "/path/to/.kube/config"]
    }
  }
}

CLI Flags

Flag	Description
`--url`	Direct URL to Kubeshark (disables cluster management tools)
`--kubeconfig`	Path to kubeconfig file for proxy mode
`--allow-destructive`	Enable destructive operations (`start_kubeshark`, `stop_kubeshark`)
`--list-tools`	List available MCP tools and exit
`--mcp-config`	Print MCP client configuration JSON and exit

Tools

Tools are fetched dynamically from the Kubeshark Hub. Run kubeshark mcp --list-tools --url <url> to see all available tools.

Cluster Management Tools (Proxy Mode Only)

Tool	Description	Requires
`check_kubeshark_status`	Check if Kubeshark is running (read-only)	-
`start_kubeshark`	Deploy Kubeshark to the cluster	`--allow-destructive`
`stop_kubeshark`	Remove Kubeshark from the cluster	`--allow-destructive`

Traffic Analysis Tools (from Hub)

Tool	Description
`list_workloads`	List pods, services, namespaces with observed traffic
`list_api_calls`	Query L7 API transactions (HTTP, gRPC, Redis, Kafka, DNS)
`get_api_call`	Get detailed information about a specific API call
`get_api_stats`	Get aggregated API statistics
`list_l4_flows`	List L4 (TCP/UDP) network flows with traffic stats
`get_l4_flow_summary`	Get L4 connectivity summary (top talkers, cross-ns traffic)
`get_dissection_status`	Check L7 protocol parsing status
`enable_dissection`	Enable L7 protocol dissection
`disable_dissection`	Disable L7 protocol dissection
`list_snapshots`	List all PCAP snapshots
`create_snapshot`	Create a new PCAP snapshot
`get_snapshot`	Get snapshot details
`delete_snapshot`	Delete a snapshot
`export_snapshot_pcap`	Export snapshot as PCAP file

Prompts

Pre-built prompts for common analysis tasks:

Prompt	Description
`analyze_traffic`	Analyze API traffic patterns and identify issues
`find_errors`	Find and summarize API errors and failures
`trace_request`	Trace a request path through microservices
`show_topology`	Show service communication topology
`latency_analysis`	Analyze latency patterns and identify slow endpoints
`security_audit`	Audit traffic for security concerns
`compare_traffic`	Compare traffic patterns between time periods
`debug_connection`	Debug connectivity issues between services

Implementation Details

Dynamic tool discovery: Tools and prompts are fetched from Hub's /api/mcp endpoint
5-minute cache TTL: Hub tools/prompts are cached to reduce latency
Cache invalidation: Cache is cleared after start_kubeshark or stop_kubeshark
Safety by default: Destructive operations require explicit --allow-destructive flag

PR: #1826
Docs: https://docs.kubeshark.co/en/mcp/cli

Source: kubeshark/kubeshark

View original on GitHub View discussion on GitHub

MCP Server Command for AI Assistant Integration