Neura Market
Wireshark-MCP logo

Wireshark-MCP

Free

Wireshark 网络数据包分析 MCP 服务器，具有抓包、协议统计、字段提取和安全分析功能。

FreeFree tier
Type
Open Source
Visit Website GitHub (40 stars)

About Wireshark-MCP

Wireshark-MCP is an MCP server that wraps tshark (and optional Wireshark suite tools) into a structured analysis interface. It allows AI assistants (e.g., Claude, Cursor, VS Code) to analyze network packet captures by simply dropping a .pcap file and asking questions in plain English. The server offers 40+ tools organized into categories: agentic workflows (security audit, quick analysis, open file), packet analysis (list, details, bytes, stream follow, search), data extraction (HTTP requests, DNS queries, TLS handshakes, field extraction), statistics (protocol hierarchy, endpoints, conversations, I/O graph, expert info), security (threat intel, credential scan, port scan, DNS tunnel, DoS detection), protocol deep dive (TCP health, ARP spoofing, SMTP, DHCP), file operations (live capture, merge, filter-save, file info), and decode/visualize (payload decode, traffic plot, protocol tree). Only tshark is required; optional tools like capinfos, mergecap, editcap, dumpcap, text2pcap enable extra features when present. Installation is via pip, with auto-configuration for multiple MCP clients.

Key Features

40+ tools organized into categories: agentic workflows, packet analysis, data extraction, statistics, security, protocol deep dive, file operations, decode/visualize
Works with Claude Desktop, Claude Code, Cursor, VS Code, and 18+ other MCP clients
Agentic workflows: wireshark_security_audit, wireshark_quick_analysis, wireshark_open_file
Packet analysis: packet list, details, bytes, context, stream follow, search
Data extraction: HTTP requests, DNS queries, TLS handshakes, field extraction
Security: threat intel, credential scan, port scan, DNS tunnel, DoS detection
Statistics: protocol hierarchy, endpoints, conversations, I/O graph, expert info
Protocol deep dive: TCP health, ARP spoofing, SMTP, DHCP
File operations: live capture, merge, filter-save, file info
Decode/Visualize: payload decode, traffic plot, protocol tree

Pros & Cons

Pros
  • Free and open source (MIT license)
  • Works with multiple AI assistants (Claude, Cursor, VS Code, etc.)
  • 40+ tools covering comprehensive network analysis
  • Integrates with existing tshark/Wireshark installation
  • Easy installation with pip and auto-configuration
  • Supports both English and Chinese documentation
  • Agentic workflows enable automated multi-step analysis
Cons
  • Requires Wireshark/tshark to be installed and on PATH
  • Dependent on tshark capabilities and may lack GUI features of full Wireshark
  • Primarily designed for MCP-compatible AI clients; not a standalone tool
  • Some advanced tools require additional Wireshark suite components (mergecap, editcap, etc.)

Best For

Network security analysis and threat detection in packet capturesDNS query analysis to find suspicious domainsExtracting HTTP requests, TLS handshakes, and other protocol data from pcap filesProtocol debugging and deep dive (TCP, ARP, SMTP, DHCP)Generating network traffic statistics and expert infoAutomated security audit of captured network trafficEducational use for learning network packet analysis

FAQ

What is Wireshark-MCP?
An MCP server that wraps tshark (and optional Wireshark suite tools) into a structured analysis interface, allowing AI assistants to analyze network packet captures by asking questions in plain English.
Which AI clients are supported?
Works with Claude Desktop, Claude Code, Cursor, VS Code, and 18+ other MCP clients.
What are the prerequisites?
Python 3.10+ and Wireshark with tshark on PATH.
How do I install it?
Run 'pip install wireshark-mcp' then 'wireshark-mcp install' to auto-configure detected MCP clients.
Is it free?
Yes, it is open source under the MIT license and free to use.