Wiremcp

🚀 WireMCP

WireMCP is a Model Context Protocol (MCP) server designed to enhance the capabilities of Large Language Models (LLMs) in real-time network traffic analysis. Leveraging the tshark tool based on Wireshark, WireMCP captures and processes real-time network data, providing structured context information to LLMs. This enables LLMs to assist in tasks such as threat hunting, network diagnosis, and anomaly detection.

✨ Features

WireMCP provides the following tools to MCP clients to enhance the LLM's understanding of network activities:

• capture_packets: Captures real-time traffic and returns raw packet data in JSON format, allowing the LLM to analyze packet-level details (e.g., IP addresses, ports, HTTP methods).
• get_summary_stats: Provides protocol-level statistical information, giving the LLM an overview of the traffic composition (e.g., TCP and UDP usage).
• get_conversations: Returns TCP/UDP session statistics, helping the LLM track communication flows between endpoints.
• check_threats: Captures IP addresses and checks their status in the URLhaus blacklist, enabling the LLM to identify potential threats.
• check_ip_threats: Performs multi-source threat intelligence queries on specific IP addresses, providing detailed reputation and threat information.
• analyze_pcap: Analyzes pcap files and generates structured output for the LLM to interpret network activities.
• generate_report: Generates natural language reports based on input data.

🤝 How it Helps LLMs

LLMs can utilize these outputs to:

• Provide natural language explanations of network activities.
• Identify patterns and potential security issues.
• Offer context-relevant suggestions.
• Generate human-readable reports.

🚀 Quick Start

Prerequisites

• Operating System: Linux or macOS (recommended).
• The tshark tool from Wireshark installed and configured.
• Node.js and npm environment.

📦 Installation

1. Clone the WireMCP repository:

git clone https://github.com/your-repository/wire-mcp.git

2. Install dependencies:

cd wire-mcp
npm install

3. Start the server:

node index.js

💻 Usage Examples

Configuration File Path

• Example configuration file path: config.json

Example Commands

curl -X POST http://localhost:3000/api/capture-packets -d '{"interface":"eth0","duration":60}'

💻 Usage Examples

Basic Usage

# Clone the repository
git clone https://github.com/your-repository/wire-mcp.git
# Install dependencies
cd wire-mcp
npm install
# Start the server
node index.js

Advanced Usage

# Use the example command to capture packets
curl -X POST http://localhost:3000/api/capture-packets -d '{"interface":"eth0","duration":60}'

📚 Documentation

Output Examples

Packet Capture Output

{
  "packets": [
    {
      "timestamp": "12:34:56.789",
      "source_ip": "192.168.1.1",
      "destination_ip": "192.168.1.2",
      "protocol": "TCP",
      "src_port": 1550,
      "dst_port": 23
    }
  ]
}

Pcap File Analysis Output

{
  "summary": {
    "total_packets": 1000,
    "unique_hosts": 5,
    "traffic_volume": "1.2 MB"
  },
  "threats": [],
  "diagnostics": {
    "highest_bandwidth_usage": "192.168.1.3:80 (HTTP)",
    "inactive_interfaces": []
  }
}

📈 Roadmap

• Expand IOC Data Sources: Currently, only URLhaus is used for threat checks. Future plans include integrating more sources (e.g., IPsum, Emerging Threats) to expand coverage.
• Enhance Reporting Functionality: Improve the generated natural language reports by adding charts and visual elements.
• Optimize Performance: Improve the efficiency of large-scale data processing.

🤝 Contribution

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

📄 License

MIT

🙏 Acknowledgments

• The Wireshark/tshark team for their excellent packet analysis tools.
• The Model Context Protocol community for developing the framework and specifications.
• URLhaus for providing threat intelligence data.