Zeek

Provides Zeek-based MCP tools to run analysis on PCAPs and parse Zeek logs via an MCP client.

python

5

GitHub Stars

python

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "gabbo01-zeek-mcp": {
      "command": "python",
      "args": [
        "Bridge_Zeek_MCP.py",
        "--mcp-host",
        "127.0.0.1",
        "--mcp-port",
        "8081",
        "--transport",
        "sse"
      ]
    }
  }
}

You can run a Zeek-based MCP server that exposes Zeek tooling to your conversational AI client. This setup lets you execute Zeek analysis on PCAPs and parse Zeek logs through convenient MCP endpoints, enabling automated, text-driven investigations and insights from network captures.

How to use

Set up the MCP server and connect your client to start using Zeek-based MCP tools. You will run the server locally, then call the provided tools to execute Zeek on PCAPs and to parse the resulting logs. Use the server’s transport SDK or standard HTTP-like endpoints exposed via the chosen transport (SSE) to interact with the tools.

How to install

# Prerequisites
- Python 3.7+
- Zeek installed and available in your PATH
- pip for Python dependencies

# Step 1: Prepare the environment
python -m venv venv
# Linux/macOS
source venv/bin/activate
# Windows
venv\Scripts\activate

# Step 2: Install dependencies
pip install -r requirements.txt
# If requirements.txt is not available, install directly:
pip install pandas mcp

# Step 3: Run the MCP server (see Command below)
python Bridge_Zeek_MCP.py --mcp-host 127.0.0.1 --mcp-port 8081 --transport sse

Additional notes

The MCP server exposes two core tools you can invoke from your client or an integrated chatbot workflow:

Tools you can use with the MCP server

execzeek(pcap_path: str) -> str: Runs Zeek on the provided PCAP file after cleaning existing .log files in the working directory. Returns a string listing the generated .log filenames or a single character string "1" if an error occurs.
parselogs(logfile: str) -> DataFrame: Parses a single Zeek .log file and returns the parsed content.

Available tools

execzeek

Runs Zeek on a given PCAP file after clearing existing .log files, returning a list of generated .log files or a failure indicator.

parselogs

Parses a Zeek .log file and returns the parsed data as a structured DataFrame.