# Install kubeshark with Homebrew, Nix, scoop API Traffic Analyzer providing real-time visibility into Kubernetes network. Version 53.3.0 via Homebrew; verified 2026-07-27. Also installable with nix: nix profile install nixpkgs#kubeshark. ## Install ```sh sudo av install brew:kubeshark ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install kubeshark ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#kubeshark ``` Evidence: nixpkgs package indexes: pkgs/by-name/ku/kubeshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ### Windows - Scoop (92%): ```sh scoop install main/kubeshark ``` Evidence: Scoop official bucket manifest trees: bucket/kubeshark.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:kubeshark - **Package manager:** Homebrew - **Package manager page:** - **Version:** 53.3.0 - **Source summary:** API Traffic Analyzer providing real-time visibility into Kubernetes network - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-07-27T21:58:47+02:00 - **Generated:** 2026-08-04T22:13:35+00:00 ## Executables - kubeshark (cli) - kubeshark (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-08-04 - Package-manager version: 53.3.0 - Package-manager updated: 2026-07-27 - Local data: ok - Upstream repository: https://github.com/kubeshark/kubeshark - Upstream latest detected: v53.3.0 (current) ## Project history and usage Kubeshark is a Kubernetes network observability tool that indexes cluster-wide traffic with Kubernetes, API, and network context. The project presents itself as eBPF-powered observability for SREs and AI agents. ### Project history Kubeshark's repository describes a tool that captures and indexes network traffic at the kernel level, exposes filtered PCAP downloads, visual dashboards, TLS and mTLS visibility, protocol parsing, and MCP access for AI-driven incident response. Its documentation packages the product around Helm deployment plus a CLI installed through Homebrew or downloaded from GitHub releases. The late-2025 and 2026 release notes show an active transition into a V2 architecture: v52.11.0 on December 16, 2025 described the first release in preparation for V2.00 and a backend refactor, while v53.3.0 on May 19, 2026 highlighted TLSX dissector behavior, authorization refactoring, L7 data boundaries, snapshots, and AI skills. ### Adoption history Kubeshark fits into the Kubernetes observability niche for teams that need packet-level or protocol-level visibility without changing application code. The package-manager angle is important because the CLI drives local workflows such as tapping traffic, cleaning deployments, connecting MCP clients, and installing the Helm chart. ### How it is used Users install Kubeshark with Helm or Homebrew, port-forward the frontend service, and query live or retained traffic through the dashboard, KFL filters, PCAP exports, APIs, or MCP integrations. ### Why package nerds care Kubeshark is notable because it packages a cluster-resident observability system behind a developer-friendly CLI. It also bridges traditional packet-analysis workflows with Kubernetes metadata and newer MCP-based AI-agent workflows. ### Timeline - 2025: v52.11.0 was released on December 16 as the first release preparing for V2.00 and introduced a refactored backend path. - 2026: v52.11.7 was released on January 15 with a complementary license for clusters up to 100 nodes. - 2026: v53.3.0 was released on May 19 with TLSX enabled by default, authorization changes, L7 data boundaries, snapshot filters, and AI skills. ### Related projects - Related projects and concepts include Kubernetes, Helm, eBPF, Wireshark, tcpdump, PCAP tooling, KFL, and Model Context Protocol integrations. ### Sources - - - ## Security Notes infrastructure mutation or orchestration signal. - **Geiger risk:** orange / medium - infrastructure mutation or orchestration signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** kubeshark - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - kubeshark: normalized package name match | nixpkgs package indexes: pkgs/by-name/ku/kubeshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Scoop - main/kubeshark: normalized package name match | Scoop official bucket manifest trees: bucket/kubeshark.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Related links - [Cloud CLI packages](https://pkg.so/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Secret-risk packages](https://pkg.so/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [go](https://pkg.so/brew/go/) - Build dependency declared by Homebrew. - [kubernetes-cli](https://pkg.so/brew/kubernetes-cli/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [k9s](https://pkg.so/brew/k9s/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [k3d](https://pkg.so/brew/k3d/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [ctlptl](https://pkg.so/brew/ctlptl/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [openshift-cli](https://pkg.so/brew/openshift-cli/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [eksctl](https://pkg.so/brew/eksctl/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [skaffold](https://pkg.so/brew/skaffold/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [cmctl](https://pkg.so/brew/cmctl/) - Shares pkgdb curated category or tags: cli, cloud-infrastructure, kubernetes. - [kubetail](https://pkg.so/brew/kubetail/) - Local package facts share a topical domain. Shared terms: cli, cloud, cloud-infrastructure, infrastructure, kubernetes. - [clusterawsadm](https://pkg.so/brew/clusterawsadm/) - Local package facts share a topical domain. Shared terms: api, cli, cloud, cloud-infrastructure, infrastructure. - [clusterctl](https://pkg.so/brew/clusterctl/) - Local package facts share a topical domain. Shared terms: api, cli, cloud, cloud-infrastructure, infrastructure. ## Combined YAML source View the package source record on GitHub. [combined/kubeshark.yml](https://github.com/mxcl/pkgdb/blob/main/combined/kubeshark.yml) ## Sources - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph