MCPCAP

MCPCAP MCP Server is a modular Python-based analysis engine for PCAP files. You can run it locally as a stateless MCP server and query specialized tools that extract protocol-specific insights from DNS, DHCP, ICMP, TCP, and CapInfos data. It is designed to work with MCP clients to enable large language models to reason about network captures without uploading files, by providing a file path or URL to the PCAP.

How to use

You run MCPCAP as an MCP server and connect your MCP client to it. Start with the default setup to enable all core analysis modules, then tailor the modules to your needs. Use the client to invoke per-protocol analysis on any PCAP file by passing either a local path or a remote URL. The server returns structured JSON data that is easy for the MCP client to interpret.

Typical usage flow: start the server, connect your MCP client, then request analysis for DNS, DHCP, ICMP, TCP, or CapInfos as needed. Each analysis accepts a PCAP file path or a remote URL, and the server keeps all analysis stateless between requests.

How to install

Prerequisites: Python 3.10 or greater must be installed on your system.

Install MCPCAP with Python’s package manager, or use a universal installer tool if you prefer.

Install with pip:

pip install mcpcap

Install with uv (for instant usage in a virtual environment):

uv add mcpcap

Install with uvx for one-time usage:

uvx mcpcap

Additional sections

Configuration and usage details help you tailor MCPCAP to your environment. You can selectively enable protocol modules, set analysis limits, and run analyses against both local PCAP files and remote PCAPs accessed via HTTP/HTTPS URLs. The server is designed to be stateless across requests and to return JSON-structured results that are easy for language models to consume.

Module and command overview: the server starts with a core set of modules by default, including DNS, DHCP, ICMP, TCP, and CapInfos. You may start with the default configuration or specify modules explicitly, for example to run only DNS and TCP analyses. You can also limit the number of packets analyzed to keep responses fast for large PCAPs.

Security and data handling: be mindful that PCAP files may contain sensitive information. Remote PCAPs are retrieved over HTTPS when possible, and temporary files are cleaned up automatically after analysis.

Notes on environment and capabilities: MCPCAP leverages Scapy for packet parsing, provides protocol-specific prompts for guidance, and outputs JSON in a format optimized for LLM consumption.

Available tools

analyze_dns_packets

Complete DNS traffic analysis that extracts queries/responses, domains, query types, frequency, and potential security indicators.

analyze_dhcp_packets

Complete DHCP traffic analysis covering DISCOVER/OFFER/REQUEST/ACK sequences, clients/servers, IP lease information, options, configurations, and anomalies.

analyze_icmp_packets

Complete ICMP traffic analysis including echo request/reply timings, reachability, TTL tracking, and ICMP error handling.

analyze_tcp_connections

TCP connection state analysis that tracks handshakes, lifecycle events, termination, and filters by server IP/port to identify issues.

analyze_tcp_anomalies

Intelligent TCP anomaly detection that diagnoses handshake failures, unusual RST patterns, high retransmissions, and provides confidence-scored recommendations.

analyze_tcp_retransmissions

TCP retransmission analysis that measures overall and per-connection retransmission rates and flags network quality issues.

analyze_traffic_flow

Bidirectional traffic flow analysis comparing client-to-server and server-to-client traffic, identifying asymmetry and connection patterns.

analyze_capinfos

PCAP metadata and statistics analysis including file information, packet counts, durations, and throughput metrics.