Repolode
Submit
bx33661

bx33661/Wireshark-MCP

An MCP server that gives AI assistants structured access to tshark, so they can analyze .pcap captures with real packet data.

Open-source alternative to:Wireshark

View on GitHub
Stars
371
Forks
47
Open issues
5
Last commit
6 days ago

What is it?

Wireshark MCP is an MCP server that wraps tshark and optional Wireshark suite tools into a structured analysis interface. Users point an MCP-compatible AI client at a capture file and ask questions in plain language, and the assistant answers by calling tools that run tshark and return its output. It works with clients such as Claude Desktop, Claude Code, Cursor and VS Code.

The server exposes 54 tools in the default profile, covering packet listing and details, HTTP and DNS extraction, aggregate statistics, and security detectors for port scans, DNS tunneling, beaconing, exfiltration and ARP spoofing. A protocol analysis tool supports 25 protocols by applying the correct fields and display filters for each. Detector results share a common finding format with evidence anchors and a tshark command for re-checking. An optional DuckDB capture index speeds up repeated queries on large files, and case files keep an investigation's findings and verdicts across sessions.

Tool output is size-bounded and each tool declares whether it reads or writes, so clients can auto-approve read-only analysis. Write-capable tools and remote HTTP binding are restricted by configured directories and loopback defaults. The package installs from PyPI with an interactive client setup command, and a Claude Code and Codex plugin route is also available.

Key features

  • 01Exposes 54 MCP tools backed by tshark output for packet, stream, statistics and security analysis.
  • 02Analyzes 25 protocols through one protocol tool that selects the right fields and display filters.
  • 03Includes detectors for DNS tunneling, port scans, beaconing, exfiltration and ARP spoofing.
  • 04Offers an optional DuckDB capture index for faster queries on large captures.
  • 05Keeps investigation findings and verdicts in JSON case files that persist across sessions.
  • 06Offers profiles that trim the tool list to reduce per-request prompt size.

Use cases

  • Asking an AI assistant to triage a .pcap file for suspicious DNS, HTTP or credential traffic.
  • Investigating when a host first appeared or how traffic changed between two captures.
  • Analyzing industrial or wireless protocols such as Modbus, S7comm, Zigbee or BLE with correct field names.
  • Running long incident investigations that need findings recorded and resumed across sessions.

Quick start

  1. 1

    Install Wireshark (which includes tshark) and make sure tshark is on your PATH

  2. 2

    Install the Python package from PyPI

    pip install wireshark-mcp
  3. 3

    Register the server with your MCP clients (choose from detected clients)

    wireshark-mcp install

Things to know

  • Requires Wireshark with tshark installed separately; the package does not install it.
  • File-reading and file-writing tools fail closed until WIRESHARK_MCP_ALLOWED_DIRS names existing directories.

In collections

Open-source AI agent frameworks & appsMCP servers

Topics

#mcp#packet-analysis#tshark#network-security#pcap#wireshark#ai-agents

FAQ

What is Wireshark-MCP?
An MCP server that gives AI assistants structured access to tshark, so they can analyze .pcap captures with real packet data. Wireshark MCP is an MCP server that wraps tshark and optional Wireshark suite tools into a structured analysis interface. Users point an MCP-compatible AI client at a capture file and ask questions in plain language, and the assistant answers by calling tools that run tshark and return its output. It works with clients such as Claude Desktop, Claude Code, Cursor and VS Code.
Is Wireshark-MCP free to use? What license does it have?
Wireshark-MCP is open source under the MIT license. Check the license terms before using it in commercial products.
Is Wireshark-MCP still maintained?
Actively maintained. The last commit to Wireshark-MCP was on Nov 1, 2026.
What can I use Wireshark-MCP for?
Asking an AI assistant to triage a .pcap file for suspicious DNS, HTTP or credential traffic. Investigating when a host first appeared or how traffic changed between two captures. Analyzing industrial or wireless protocols such as Modbus, S7comm, Zigbee or BLE with correct field names. Running long incident investigations that need findings recorded and resumed across sessions.
How do I install Wireshark-MCP?
Install Wireshark (which includes tshark) and make sure tshark is on your PATH Install the Python package from PyPI: pip install wireshark-mcp Register the server with your MCP clients (choose from detected clients): wireshark-mcp install
Where can I get Wireshark-MCP?
The source code and installation instructions are on GitHub: https://github.com/bx33661/Wireshark-MCP

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects