Wireshark MCP

🚀 Wireshark MCP Server

This project exposes PyShark functionality through the Model Context Protocol (MCP), enabling AI assistants like Claude to interact with network packet capture and analysis capabilities.

🚀 Quick Start

📦 Installation

1. Install the required dependencies:

# Use uv (recommended)
uv add mcp[cli] pyshark

# Or use pip
pip install mcp[cli] pyshark

2. Clone this repository:

git clone https://github.com/A-G-U-P-T-A/wireshark-mcp
cd wireshark-mcp

⚙️ Requirements

• Python 3.8+
• TShark (the command-line component of Wireshark) must be installed
• Administrative/root privileges for real-time packet capture

💻 Usage Examples

Running the Server

You can run the server in development mode and use the MCP inspector:

mcp dev pyshark_mcp.py

Or install it directly in Claude Desktop:

mcp install pyshark_mcp.py

Available Features

This MCP server exposes the following:

Resources

• pyshark://version - Get PyShark version information
• pyshark://config - Get PyShark configuration
• pyshark://capture-history - Get the previous packet capture history

Tools

• list_interfaces - List all available network interfaces
• capture_live_packets - Capture packets live from a network interface
• read_pcap_file - Read and analyze a packet capture file
• analyze_traffic - Analyze network traffic patterns in the captured packets

Advanced tools provided in advanced_captures.py:

• capture_targeted_traffic - Capture traffic targeted to a specific host, port, or protocol
• capture_to_file - Capture network traffic and save it as a pcap file
• analyze_http_traffic - Analyze HTTP traffic in the capture file
• detect_network_protocols - Detect and report the network protocols in use

Tips

• packet_capture_help - Provide help information on using PyShark for packet capture

Example Usage in Claude

Once the server is installed in Claude Desktop, you can interact with it like this:

You: What network interfaces are available for capture?

Claude: Let me check the available network interfaces on your system.
[Invoke the list_interfaces tool]

You: Can you capture HTTP traffic for 10 seconds?

Claude: I'll capture HTTP traffic for 10 seconds.
[Invoke capture_live_packets with appropriate parameters]

You: Can you analyze the traffic I just captured?

Claude: Here's the analysis of the captured traffic:
[Invoke analyze_traffic to provide insights]

Always ensure you have the permission to capture network traffic.

⚠️ Important Note

Network packet capture is a sensitive operation. Please ensure:

1. You have legal authorization to capture network traffic.
2. You comply with all applicable laws and regulations.
3. You do not accidentally capture sensitive or private data.
4. You handle the capture files securely to prevent unauthorized access.

Requirements

• PyShark: A Python wrapper for TShark
• TShark: The command-line version of Wireshark (must be installed separately)
• Administrative privileges: Usually required for real-time packet capture