Wireshark Mcp
Exposes Wireshark's tshark command-line analyzer through MCP tools so you can drop pcap files into Claude and ask questions in natural English. Built on Python 3.10+, it requires tshark as a minimum dependency but auto-detects the full Wireshark suite (capinfos, mergecap, editcap, dumpcap, text2pcap) to unlock additional analysis capabilities when present. Ships with a CLI that auto-configures two dozen MCP clients including Claude Desktop, Cursor, and VS Code in one command. Useful for security researchers and network engineers who want conversational packet analysis without switching contexts. Live capture works when dumpcap is available but falls back to tshark. Cross-platform CI validates on Windows, Linux, and macOS.
- GitHub stars
- 137
- tools
- 7
- transport
- STDIO
- last updated
- Mar 16, 2026
Tools
7 toolsPublic tool metadata for what this MCP can expose to an agent.
wireshark_open_fileEntry & Workflow tool for opening a capture file.
Entry & Workflow tool for opening a capture file.
No parameter schema in public metadata yet.
wireshark_quick_analysisEntry & Workflow tool for a quick analysis of a capture.
Entry & Workflow tool for a quick analysis of a capture.
No parameter schema in public metadata yet.
wireshark_casePersistent investigation case files.
Persistent investigation case files.
No parameter schema in public metadata yet.
wireshark_analyze_protocolTakes a protocol argument (for example tls_handshakes, mqtt, modbus, s7comm, zigbee, wifi, rtp, kerberos) and applies the right fields and display filter for it.
Takes a protocol argument (for example tls_handshakes, mqtt, modbus, s7comm, zigbee, wifi, rtp, kerberos) and applies the right fields and display filter for it.
No parameter schema in public metadata yet.
wireshark_indexOne tshark pass into a local DuckDB file, with read-only SQL, multi-capture sets, first-seen timelines, capture/window diffs and Parquet export.
One tshark pass into a local DuckDB file, with read-only SQL, multi-capture sets, first-seen timelines, capture/window diffs and Parquet export.
No parameter schema in public metadata yet.
wireshark_aggregateReuses the capture index for aggregate queries.
Reuses the capture index for aggregate queries.
No parameter schema in public metadata yet.
wireshark_extract_fieldsReuses the capture index to extract arbitrary fields.
Reuses the capture index to extract arbitrary fields.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Wireshark MCP
Give your AI assistant a packet analyzer.
Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
Details
- Repository
- github.com/bx33661/wireshark-mcp
- Website
- github.com/bx33661/Wireshark-MCP
- Category
- Security & Pentesting
- Package
wireshark-mcp- Transport
- STDIO
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
Virustotalburtthecoder/mcp-virustotalMCP server for querying VirusTotal API with comprehensive security analysis tools.133stars
Mcp Observatorykryptosai/mcp-observatoryMCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF.121stars
Shellwardjnmetacode/shellwardAI agent security: 7 MCP tools for injection detection, PII scanning, command safety, DLP.108stars
Depwiredepwire/depwireDependency graph + 24 MCP tools. Impact analysis, simulation, security, agent coordination71stars
Mcpsnyk/studio-mcpEasily find and fix security issues in your applications leveraging Snyk platform capabilities.0stars
MCP Supersetbintocher/mcp-supersetApache Superset MCP server — 135+ tools for dashboards, charts, datasets, SQL Lab, and security45stars