home / mcp / wireshark mcp server

Wireshark MCP Server

Provides a Python-based MCP server to analyze and visualize Wireshark captures via MCP clients.

Installation

Add the following to your MCP client configuration file.

Configuration

{
  "mcpServers": {
    "bx33661-wireshark-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/inspector",
        "uv",
        "run",
        "wireshark-mcp"
      ]
    }
  }
}

Wireshark MCP provides a simple server to enable WHIreshark-based vibe packet analysis through MCP clients. It lets you dissect and inspect network captures by exposing a set of tools that analyze pcap data, extract useful information, and visualize traffic, all via MCP-enabled interfaces so you can work with your preferred client.

How to use

You use this server by launching it as an MCP stdio server and then connecting from an MCP client to run analysis tools on your packet captures. Start the server with the MCP command shown in the Development section, then configure your MCP client to point to this local server and invoke the available tools as needed. For example, you can list packets in a capture, inspect details for specific frames, follow streams, extract HTTP requests or DNS queries, and generate summaries or visualizations.

How to install

Prerequisites you need before installing this MCP server:

Python 3.10 or higher

Wireshark installed
tshark in PATH

Claude Code
Claude
Cursor
VS Code with generic MCP client extension
Other MCP Clients

Install the latest version of the Wireshark MCP package or install directly from source.

pip install wireshark-mcp

Additional content

To connect a client, you can also run the server directly if it is installed in your environment. The recommendation is to use the explicit MCP command shown below in the Development section to test against a real client.

Available tools

wireshark_get_packet_list

Get a summary list of packets from a pcap file with optional limits and custom columns to tailor the view.

wireshark_get_packet_details

Fetch full JSON details for a specific packet frame with optional layer filtering to reduce output.

wireshark_get_packet_bytes

Retrieve the raw hex/ASCII dump for a given packet frame.

wireshark_get_packet_context

View surrounding packets around a specific frame to understand context.

wireshark_follow_stream

Reassemble and view an entire TCP/HTTP stream with support for pagination and search.

wireshark_search_packets

Find packets by pattern with options to search in raw bytes or decoded fields (Regex supported).

wireshark_read_packets

Deprecated: use get_packet_details instead.

wireshark_extract_fields

Extract specific fields from a capture into tabular data.

wireshark_extract_http_requests

Convenience tool to extract HTTP method, URI, and host information.

wireshark_extract_dns_queries

Convenience tool to extract DNS query names and related data.

wireshark_list_ips

List unique IP addresses appearing in the capture (source, destination, or both).

wireshark_export_objects

Extract embedded files from traffic (e.g., HTTP, SMB) into a destination directory.

wireshark_verify_ssl_decryption

Verify TLS decryption using a keylog file.

wireshark_decode_payload

Decode common payload encodings with smart auto-detection (Base64, Hex, URL, etc.).

wireshark_plot_traffic

Generate an ASCII visualization of traffic over time.

wireshark_plot_protocols

Display an ASCII tree view of the protocol hierarchy in the capture.

wireshark_stats_protocol_hierarchy

Produce Protocol Hierarchy Statistics from the capture.

wireshark_stats_endpoints

List endpoints and their traffic statistics.

wireshark_stats_conversations

Show communication pairs and their statistics.

wireshark_stats_io_graph

Provide I/O graph data for traffic over time.

wireshark_stats_expert_info

Retrieve expert information including anomalies and warnings.

wireshark_stats_service_response_time

Compute service response time statistics for a protocol like HTTP.

wireshark_get_file_info

Get detailed metadata about a capture file (capinfos).

wireshark_merge_pcaps

Merge multiple capture files into a single output file.

wireshark_list_interfaces

List available network interfaces for live capture.

wireshark_capture

Capture live traffic from a specified interface into a file.

wireshark_filter_save

Filter packets from a capture and save to a new file.

wireshark_check_threats

Check captured IPs against threat intelligence sources.

wireshark_extract_credentials

Scan for plaintext credentials within the capture data.

wireshark_decode_payload

Decode common payload encodings with auto-detection.