Installation
1. Install Kubeshark CLI
# macOS
brew install kubeshark
# Linux
sh <(curl -Ls https://kubeshark.com/install)
# Windows (PowerShell)
choco install kubeshark
Or download from GitHub Releases.
2. Configure Claude Desktop
Add to your Claude Desktop configuration:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Default (requires kubectl access / kube context)
{
"mcpServers": {
"kubeshark": {
"command": "kubeshark",
"args": ["mcp"]
}
}
}
With an explicit kubeconfig path:
{
"mcpServers": {
"kubeshark": {
"command": "kubeshark",
"args": ["mcp", "--kubeconfig", "/path/to/.kube/config"]
}
}
}
URL Mode (no kubectl required)
Use this when the machine doesn't have kubectl access or a kube context.
Connect directly to an existing Kubeshark deployment:
{
"mcpServers": {
"kubeshark": {
"command": "kubeshark",
"args": ["mcp", "--url", "https://kubeshark.example.com"]
}
}
}
For a gated Hub (AUTH_ENABLED=true), URL mode can't mint a token (no kube
access), so supply one explicitly via --token (or the KUBESHARK_HUB_TOKEN
env var). Mint it from a machine that has cluster access:
kubectl create token kubeshark-cli -n <release-namespace> --audience kubeshark-hub
{
"mcpServers": {
"kubeshark": {
"command": "kubeshark",
"args": ["mcp", "--url", "https://kubeshark.example.com", "--token", "<token>"]
}
}
}
The token is short-lived (~1h) and URL mode cannot auto-renew it; when it
expires the server reports a clear 401 ... token expired/invalid message — re-mint
and restart. Proxy mode (default, with kube access) mints the kubeshark-cli
token automatically and auto-renews it, so long-running sessions don't expire.
With Destructive Operations
{
"mcpServers": {
"kubeshark": {
"command": "kubeshark",
"args": ["mcp", "--allow-destructive", "--kubeconfig", "/path/to/.kube/config"]
}
}
}