mcp-wireshark

Overview

mcp-wireshark is a production-ready MCP server that provides Claude Desktop, VS Code, and CLI with direct access to network packet capture and analysis capabilities. It exposes 10 tools divided into read operations (safe inspection) and write operations (capture and export), allowing AI assistants to summarize PCAP files, apply display filters, follow TCP/UDP streams, capture live traffic, and export data to JSON. The server is cross-platform, typed, tested, and pip-installable with clear documentation and maintenance.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• check_installation

  Verify tshark is installed and show version

  Try:Run check_installationTry:Is tshark installed?
• list_interfaces

  List network interfaces available to capture from

  Try:List my network interfacesTry:What capture interfaces are available?
• read_pcap

  Read packets from a .pcap/.pcapng file

  Try:Read ./capture.pcapTry:Show me packets in traffic_analysis.pcapng
• display_filter

  Apply a Wireshark display filter to a pcap

  Try:Filter ./traffic.pcap for HTTP requestsTry:Show only DNS packets in capture.pcap
• summarize_pcap

  Generate high-level summary of pcap including stats and top talkers

  Try:Summarize ./capture.pcapTry:What's in this traffic dump?
• stats_by_proto

  Get protocol hierarchy statistics from a pcap

  Try:Show protocol breakdown of ./traffic.pcapTry:Which protocols are most common in capture.pcap?
• follow_tcp

  Reassemble a TCP stream and return its payload

  Try:Follow TCP stream 0 in ./traffic.pcapTry:Show me the content of TCP stream 5
• follow_udp

  Reassemble a UDP stream and return its payload

  Try:Follow UDP stream 3 in capture.pcapTry:What's in UDP stream 2 from the file?
• live_capture

  Capture live traffic from an interface

  Try:Capture 30 seconds of traffic on Wi-FiTry:Get 1000 packets from eth0
• export_json

  Export packets from a pcap to a JSON file

  Try:Export every DNS packet from ./traffic.pcap to dns.jsonTry:Save HTTP requests from capture.pcap as http.json

Comparable tools

Installation

pip install mcp-wireshark
claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

{
    "mcpServers": {
        "wireshark": {
            "command": "mcp-wireshark"
        }
    }
}

{
    "servers": {
        "wireshark": {
            "command": "mcp-wireshark"
        }
    }
}

FAQ

How do I install tshark on Windows?

Install Wireshark from https://www.wireshark.org/download.html and add 'C:\Program Files\Wireshark' to your system PATH.

What are the permissions needed for live capture on Linux?

Add yourself to the 'wireshark' group with 'sudo usermod -aG wireshark $USER', then log out and back in.

Compare mcp-wireshark with