AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
MCP verified MIT Self-run

Wireshark MCP

mcp-bx33661-wireshark-mcp · by bx33661

Wireshark-MCP，Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

↗ Repository
— No reviews yet
0 installs
13 views
0.0% view→install

Install

$ agentstack add mcp-bx33661-wireshark-mcp

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Wireshark MCP? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Wireshark MCP

Give your AI assistant a packet analyzer.

Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

English • 中文 • Changelog • Contributing

What is this?

An MCP server that wraps tshark (and optional Wireshark suite tools) into a structured analysis interface. Works with Claude Desktop, Claude Code, Cursor, VS Code, and [18+ other MCP clients](docs/manual-configuration.md).

You:    "Find all DNS queries going to suspicious domains in this capture."
Claude: [calls wireshark_extract_dns_queries → wireshark_check_threats]
        "Found 3 queries to domains flagged by URLhaus: ..."

Install

Prerequisites: Python 3.10+ and Wireshark with tshark on PATH.

pip install wireshark-mcp
wireshark-mcp install   # auto-configures all detected MCP clients

Restart your AI client — done.

Run wireshark-mcp doctor if anything looks off. See [docs/manual-configuration.md](docs/manual-configuration.md) for manual setup or platform-specific notes.

Quick Start

Point your AI client at a .pcap file and try:

Analyze capture.pcap using the Wireshark MCP tools.
Start with wireshark_open_file, then run wireshark_security_audit.
Write findings to report.md.

Tools

40+ tools organized into categories:

| Category | Highlights | Count | |----------|-----------|:-----:| | Agentic Workflows | wireshark_security_audit, wireshark_quick_analysis, wireshark_open_file | 4 | | Packet Analysis | Packet list, details, bytes, context, stream follow, search | 7 | | Data Extraction | HTTP requests, DNS queries, TLS handshakes, field extraction | 6 | | Statistics | Protocol hierarchy, endpoints, conversations, I/O graph, expert info | 6 | | Security | Threat intel, credential scan, port scan, DNS tunnel, DoS detection | 6 | | Protocol Deep Dive | TCP health, ARP spoofing, SMTP, DHCP | 5 | | File Ops & Capture | Live capture, merge, filter-save, file info | 5 | | Suite Utilities | editcap trim/split/dedup, text2pcap import | 5 | | Decode & Visualize | Payload decode, traffic plot, protocol tree | 3 |

The server starts with only tshark required. Optional tools (capinfos, mergecap, editcap, dumpcap, text2pcap) are auto-detected and enable extra features when present.

Documentation

| Topic | Link | |-------|------| | Platform setup (macOS/Linux/Windows) | [docs/platform-validation.md](docs/platform-validation.md) | | Manual client configuration | [docs/manual-configuration.md](docs/manual-configuration.md) | | Prompt templates | [docs/prompt-engineering.md](docs/prompt-engineering.md) | | Release checklist | [docs/release-checklist.md](docs/release-checklist.md) | | Contributing | [CONTRIBUTING.md](CONTRIBUTING.md) | | Changelog | [CHANGELOG.md](CHANGELOG.md) | | Security policy | [SECURITY.md](SECURITY.md) |

Development

pip install -e ".[dev]"
pytest tests/ -v
ruff check src/ tests/

See [CONTRIBUTING.md](CONTRIBUTING.md) for the full guide.

MIT License · Report a Bug

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Integrations