Log inSubmit server
Wireshark MCP logo

Wireshark MCP

by bx33661

MCP tools for tshark-backed packet capture, filtering, protocol statistics, field extraction, and traffic analysis.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Wireshark MCP

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "bx33661-wireshark-mcp": {
      "command": "uvx",
      "args": [
        "wireshark-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

bx33661/Wireshark-MCP MCP server connects AI clients to Wireshark command-line analysis through MCP. It supports packet capture, pcap file operations, display-filtered analysis, protocol statistics, field extraction, stream following, and selected TLS decryption workflows. Reach for it when an agent needs structured findings from live traffic or existing capture files instead of manually inspecting Wireshark output. The server requires tshark, while several file and capture operations depend on optional Wireshark suite utilities.

Use cases

  • Analyze a pcap for protocol distribution, top talkers, and anomalies
  • Capture live traffic with a BPF filter and ring buffer
  • Extract selected packet fields into tabular output
  • Follow an HTTP, TLS, TCP, or UDP stream
  • Trim, split, merge, or deduplicate capture files

Key features

  • Live packet capture and interface listing
  • Packet details, bytes, context, and content search
  • Protocol, endpoint, conversation, and response-time statistics
  • Capture filtering, editing, merging, and text2pcap conversion
  • Stream reassembly and TLS decryption
  • Decode-as and protocol preference overrides

Tools52

What Wireshark MCP lets your agent do. Expand a tool for its parameters.

Verified live~3.7k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

18/18 checks healthy over the last 77d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 1Low 1

Scanned 7d ago via OSV.dev · wireshark-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars353Stargazers on the source repository.
Last commit2d agoMost recent push to the default branch.
Tools exposed52Callable tools this server registers over MCP.
Directory activity11 viewsConfig copies, upvotes, and views on AllMCPs.

How Wireshark MCP works

What bx33661/Wireshark-MCP MCP server does

bx33661/Wireshark-MCP MCP server exposes Wireshark and tshark operations as structured MCP tools for network traffic investigation. It can inspect existing capture files, capture traffic from a local interface, transform or reorganize pcap files, and return packet-level or capture-wide results.

The analysis surface covers metadata, packet lists, packet details, raw packet bytes, nearby packet context, content searches, extracted protocol fields, and reassembled TCP, UDP, TLS, HTTP, or HTTP/2 streams. Statistics tools report protocol hierarchy, endpoints, conversations, I/O volumes, expert information, service response times, filtered counts, groups, distinct values, numeric metrics, top results, and time buckets.

For security work, the server can support anomaly investigation through expert information, traffic aggregation, decode-as rules, protocol preference overrides, and TLS decryption using an SSL key log file. These capabilities make it suitable for incident triage, troubleshooting, protocol review, and repeatable analysis of supplied captures.

How it works

The MCP client sends a tool call to the server, which invokes tshark or an available Wireshark command-line utility and returns structured output. Display filters, BPF capture filters, protocol names, field lists, packet ranges, timestamps, and stream output modes are passed as tool parameters.

wireshark_quick_analysis provides a single-call overview containing file information, protocol usage, top talkers, conversations, hostnames, and anomalies. More focused workflows can combine wireshark_get_packet_list, wireshark_get_packet_details, and wireshark_extract_fields. The aggregate tool handles capture-wide distributions and counts without requiring an agent to inspect every packet individually.

Optional utilities are detected at startup. capinfos supports capture metadata, while mergecap, editcap, dumpcap, and text2pcap enable additional file, capture, and conversion operations when installed.

Setup and configuration

Install Python 3.10 or newer and Wireshark with tshark available on the system PATH. The Python package can be installed with pip, followed by the project’s client-registration command. The repository also documents plugin installation for Claude Code and Codex using uv; that route does not install Wireshark or capture drivers.

After client configuration, restart the MCP client. The repository provides a diagnostic command for troubleshooting and a manual-configuration path for platform-specific setups. bx33661/Wireshark-MCP MCP server can advertise reduced profiles: the default includes the full tool surface, while analysis and core profiles omit selected capture, writing, decryption, dissection, or low-level tools.

File-writing tools require WIRESHARK_MCP_ALLOWED_DIRS to identify existing permitted directories. Results are bounded by default at 8,000 characters and can be adjusted with WIRESHARK_MCP_MAX_RESULT_CHARS; pagination parameters are available for retrieving more output.

Tools and capabilities

  • List interfaces and capture live traffic with BPF filters and ring-buffer settings.
  • Inspect, merge, trim, split, time-shift, deduplicate, filter, and convert capture files.
  • Retrieve packet summaries, detailed layers, bytes, context, and searched content.
  • Extract fields such as IP addresses, ports, and HTTP hostnames as tabular data.
  • Analyze protocols, endpoints, conversations, response times, expert findings, and I/O graphs.
  • Follow streams, apply decode-as rules, override protocol preferences, and decrypt TLS with SSLKEYLOGFILE.

Limitations and notes

The server depends on local Wireshark command-line components, and optional tools determine which capture and file-management features are available. Live capture also depends on accessible network interfaces and the host’s capture permissions. TLS decryption requires suitable key-log data; the tool does not imply that encrypted traffic can always be decrypted.

The default profile exposes a relatively large tool schema, which adds context to client requests. Smaller profiles reduce that surface. Remote HTTP or SSE binding remains loopback-only unless insecure HTTP is explicitly enabled behind a trusted authenticated TLS proxy. These controls matter when deploying bx33661/Wireshark-MCP MCP server in the Security category.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Wireshark MCP

bx33661/Wireshark-MCP is an MCP server that connects AI clients to Wireshark’s tshark command-line tools. Its main tools capture traffic, inspect pcap files, retrieve packet details and bytes, extract fields, calculate protocol statistics, follow streams, apply filters, and perform selected capture-file operations.

Install Python 3.10+ and Wireshark with tshark on PATH, then install the wireshark-mcp Python package and run its client installation command. Claude Code and Codex also have a documented uv-based plugin route. Restart the client after registration.

Yes, Cursor is named as a supported MCP client in the repository documentation. The traditional Python package route can register the server with detected clients, while manual configuration is available for client-specific setup.

Some tools depend on optional Wireshark utilities such as capinfos, mergecap, editcap, dumpcap, or text2pcap. File-writing tools also fail closed until WIRESHARK_MCP_ALLOWED_DIRS names existing permitted directories.

Start the server with an analysis or core profile instead of the default full profile. These profiles remove selected live-capture, file-writing, decryption, dissection, and low-level tools to reduce the schema sent to the client.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewWireshark MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/bx33661-wireshark-mcp?style=directory)](https://allmcps.com/mcp/bx33661-wireshark-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/bx33661-wireshark-mcp"><img src="https://allmcps.com/api/badge/bx33661-wireshark-mcp?style=directory" alt="Wireshark MCP on AllMCPs" /></a>