Wireshark MCP

Give your AI assistant a packet analyzer.
Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

English · 中文 · Changelog · Contributing

What is this?

Wireshark MCP is an MCP Server that wraps tshark into structured tools, letting AI assistants like Claude or Cursor perform deep packet analysis without you touching the command line.

You:    "Find all DNS queries going to suspicious domains in this capture."
Claude: [calls wireshark_extract_dns_queries → wireshark_check_threats]
        "Found 3 queries to domains flagged by URLhaus: ..."

Prerequisites

• Python 3.10+
• Wireshark installed with tshark available in your PATH
• Any MCP-compatible client: Claude Desktop, Claude Code, Cursor, VS Code, etc.

Installation

pip install wireshark-mcp

pip install git+https://github.com/bx33661/Wireshark-MCP.git

Configuration

{
  "mcpServers": {
    "wireshark": {
      "command": "uv",
      "args": ["tool", "run", "wireshark-mcp"]
    }
  }
}

claude mcp add wireshark -- uv tool run wireshark-mcp

{
  "mcpServers": {
    "wireshark": {
      "command": "uv",
      "args": ["tool", "run", "wireshark-mcp"]
    }
  }
}

codex mcp add wireshark -- uv tool run wireshark-mcp

[mcp_servers.wireshark]
command = "uv"
args = ["tool", "run", "wireshark-mcp"]

{
  "mcpServers": {
    "wireshark": {
      "command": "uv",
      "args": ["tool", "run", "wireshark-mcp"]
    }
  }
}

Docker / SSE mode: docker compose up -d then point your client to http://localhost:8080/sse

Quick Start

Paste this into your AI client after pointing it at a pcap file:

Analyze <path/to/file.pcap> using the Wireshark MCP tools.

- Start with wireshark_get_packet_list to map the traffic.
- Drill into interesting frames with wireshark_get_packet_details.
- For TCP/HTTP sessions, use wireshark_follow_stream.
- Never guess — always verify with tools.
- Write findings to report.md.

Tools

MCP Resources

MCP Prompts

Development

Install dev dependencies:

pip install -e ".[dev]"

Test with the MCP Inspector (opens a local web UI to call tools interactively):

npx -y @modelcontextprotocol/inspector uv run wireshark-mcp

Run the test suite:

pytest tests/ -v

Lint & type check:

ruff check src/ tests/
mypy src/wireshark_mcp/

Docker:

docker compose up -d
# Pcap files go in ./pcaps/ (mounted as /data)

CLI options:

wireshark-mcp --version
wireshark-mcp --transport sse --port 8080 --log-level INFO

See CONTRIBUTING.md for the full development setup guide.