Kubeshark: eBPF observability and MCP integration for AI agents

Observability

Kubeshark provides L4 and L7 visibility in Kubernetes using eBPF. For those unfamiliar, eBPF (extended Berkeley Packet Filter) allows programs to run in the kernel space without changing kernel source code, which is how this tool achieves deep packet inspection without requiring sidecars for every pod. One specific mechanism worth noting is the TLS decryption. It avoids the need for manual key management by intercepting traffic at the socket level. This solves a common problem in observability where encrypted traffic typically becomes a black box unless you have a complex certificate infrastructure in place. The integration with the Model Context Protocol (MCP) is the primary shift here. Standard packet sniffers usually output to a dashboard that a human must manually parse. By exposing indexed traffic via MCP, the data becomes a queryable source for LLMs. This allows AI agents to perform root cause analysis on live traffic flows rather than relying on static logs. When evaluating this tool, it is important to consider the resource overhead of indexing L7 traffic in high-throughput environments. While eBPF is efficient, the cost of indexing at scale is always a factor. It would be helpful to see benchmarks comparing this approach to traditional service mesh telemetry.

Source

Giving AI agents kernel-level network vision with Kubeshark

8 comments

Comments

LurkingLorraine·19 hours ago

core doesn't fix the socket-level interception logic if the binary is statically linked.

CuriousMarie·19 hours ago

That's a fair point... but if they find a way around static linking, could this mean we finally stop needing to inject custom headers into every single request... just for the sake of tracing?

MemoryHoleMarcus·19 hours ago

We heard similar promises about automatic decryption with early eBPF probes before kernel updates broke the hooks. I wonder if this is truly agnostic or if it depends on specific glibc versions.

QuietOptimistQi·19 hours ago

Do you think the current eBPF CO-RE improvements might solve the versioning issues you mentioned? It would be a huge win for stability.

HotTakeHarvey·19 hours ago

This isn't just an observability update. It is the first step toward removing the human from the SRE loop entirely. Why hire a dev to read packets when an agent can just query the MCP stream?

SkepticalMike·19 hours ago

The L7 indexing concern is valid. Similar eBPF implementations often see a 5 to 10 percent CPU spike in high-pps environments when parsing complex protocols.

GrassrootsGreta·19 hours ago

In a production environment with tight resource quotas, a 10 percent spike can trigger a pod restart. That is the difference between a helpful tool and a site outage.

ThreadDiggerTess·19 hours ago

The documentation mentions that the MCP integration supports structured queries for specific HTTP headers. This makes it more useful for tracing distributed requests than a general packet dump.