* deps: bump indirect deps to clear critical/high Dependabot alerts
Bumps the vulnerable indirect dependencies flagged as critical or high
severity in Dependabot:
- golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent
constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence
check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on
large channel writes, client-induced server deadlock, RSA/DSA DoS, byte
arithmetic underflow panic)
- google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via
missing leading slash in :path; high: xDS RBAC and HTTP/2 issues)
- github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL ->
restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local
privesc via wide CRI directory permissions)
- oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink
extract-dir escape, credential forwarding via unvalidated Location header)
- github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI)
Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time,
x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy.
The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules);
the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no
workflow changes are needed.
go build ./... and go test ./... pass.
* ci: move golangci-lint to v2, fix resulting lint issues
golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with
go1.24 and refuses to run now that go.mod targets 1.25.0:
can't load config: the Go language version (go1.24) used to build
golangci-lint is lower than the targeted Go version (1.25.0)
Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml
mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and
unused, plus gofmt/goimports as formatters.
Fixes for the issues that surfaced:
- ST1005: lowercase error strings, drop trailing '!' in connect/hub.go
- SA4011: kubernetes/watch.go had a `break` inside a `select` default
that broke the select rather than the loop, i.e. a no-op; removed
- QF1008: drop the embedded ChartPathOptions selector in helm.go
- QF1003: tagged switch on r.URL.Path in mcp_test.go
- QF1004: strings.Replace(..., -1) -> strings.ReplaceAll
- gofmt -s and goimports with a local prefix across the tree
errcheck is not in the enabled set, matching hub.
* cmd: clarify --time parse error in pcap dump
The error neither named the offending flag/value nor separated the
wrapped error from the message. Reported by Copilot on #1952.
---------
Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
* Add MCP (Model Context Protocol) server command
Implement `kubeshark mcp` command that runs an MCP server over stdio,
enabling AI assistants to query Kubeshark's network visibility data.
Features:
- MCP protocol implementation (JSON-RPC 2.0 over stdio)
- Dynamic tool discovery from Hub's /api/mcp endpoint
- Local cluster management tools (check_kubeshark_status, start_kubeshark, stop_kubeshark)
- --url flag for direct connection to existing Kubeshark deployment
- --kubeconfig flag for proxy mode with kubectl
- --allow-destructive flag to enable start/stop operations (safe by default)
- --list-tools flag to display available tools
- --mcp-config flag to generate MCP client configuration
- 5-minute cache TTL for Hub tools/prompts
- Prompts for common analysis tasks
* Address code review comments for MCP implementation
- Add 30s timeout to HTTP client to prevent hanging requests
- Add scanner.Err() check after stdin processing loop
- Close HTTP response bodies to prevent resource leaks
- Add goroutine to wait on started process to prevent zombies
- Simplify polling loop by removing ineffective context check
- Advertise check_kubeshark_status in URL mode (was callable but hidden)
- Update documentation to clarify URL mode only disables start/stop
* Fix lint errors in mcpRunner.go
- Use type conversion instead of struct literals for hubMCPTool -> mcpTool
and hubMCPPromptArg -> mcpPromptArg (S1016 gosimple)
- Lowercase error string to follow Go conventions (ST1005 staticcheck)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* updated helm values
* removed the tap.debug field
from the tapConfig struct
* Revert "removed the tap.debug field"
This reverts commit f911c02f0d.
* support the -d --debug command
with the new logLevel flag
* Add hub to the list of containers in `pprof` command and add flags to `pprof` command
* Reduce duplication
---------
Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
* Use `github.com/rs/zerolog` for logging
* Use `github.com/rs/zerolog` for logging (continue)
* Add `debug` flag
* Remove `github.com/op/go-logging` dependency completely
* Fix linter
* Remove `logger` module
* Remove `shared` module
* Move `cli` folder contents into project root
* Fix linter
* Change the module name from `github.com/kubeshark/kubeshark/cli` to `github.com/kubeshark/kubeshark`
* Set the default `Makefile` rule to `build`
* Add `lint` rule
* Fix the linter errors
Volodymyr StoikoandAlon Girmonsky
M. Mert YildiranandAlon Girmonsky
guangwuandM. Mert Yildiran
kindknowandAlon Girmonsky