Wireshark MCP Server Container

You can run a containerized MCP server that analyzes network traffic with Wireshark and tshark, connect it to any MCP client, and perform automated security analysis, protocol inspection, and traffic forensics with a stateless, GitHub-backed workflow.

How to use

You operate this MCP server by running it as a local process (stdio) and connecting your MCP-compatible AI client. The server pulls PCAP data on demand from your GitHub repository, analyzes it with built-in Wireshark tools, and exposes analysis results through the MCP endpoints. Start by listing available PCAPs, sync the ones you need into the container workspace, run analyses, and then clean up when you are finished.

How to install

Prerequisites you need on your machine before running the server:

• Python 3.11+ required

• tshark installed via your system package manager

• GitHub username and Personal Access Token (PAT) with repo scope for private repos

• Docker is used if you run a containerized workflow

Step-by-step flow to run the server locally from source

python server.py

Additional setup notes

The server is designed to be stateless and ephemeral. PCAP data remains in your GitHub repository; the container pulls only what is needed for the current analysis session.

Configuration and usage notes

All configuration happens through environment variables. You can also pass credentials per-request via HTTP headers if you operate a shared server instance.

Typical workflow example

1. List available PCAPs from GitHub to see what has been uploaded. 2. Sync a chosen PCAP into the container workspace. 3. Run an initial triage to get an overview and recommendations. 4. Drill into TCP health and other deeper analyses if issues are flagged. 5. Apply filters to focus on specific traffic patterns. 6. Reconstruct streams to examine application conversations. 7. Check IPs against threat intelligence feeds. 8. Clean up the workspace when complete.

Security considerations

Treat PCAP data as sensitive when stored in private GitHub repos. Use private repos and rotate credentials regularly. Enable access logs to monitor usage when applicable.

Available tools

wireshark_list_pcaps

List synced and available PCAPs from local workspace and GitHub

wireshark_sync_pcap

Download a single PCAP from GitHub into the container workspace

wireshark_sync_all_pcaps

Download all PCAPs from GitHub into the container workspace, skipping already-synced files

wireshark_remove_pcap

Remove a local PCAP copy from the workspace

wireshark_clean_project

Remove the entire project workspace and its PCAPs from the container

wireshark_pcap_triage

Automated first-pass triage to provide an initial overview and recommendations

wireshark_analyze_pcap

Comprehensive packet analysis across the synced PCAPs

wireshark_protocol_hierarchy

Protocol distribution breakdown across the PCAPs

wireshark_conversations

Statistics on TCP/UDP/IP conversations observed in PCAPs

wireshark_display_filter

Apply Wireshark display filters to focus on traffic patterns

wireshark_follow_stream

Reconstruct TCP/UDP stream payloads for detailed inspection

wireshark_top_talkers

Identify the highest-volume traffic sources in the PCAPs

wireshark_tcp_health

TCP health indicators including retransmissions and dup ACKs

wireshark_dns_analysis

DNS queries, NXDOMAINs, and tunneling indicators

wireshark_http_summary

HTTP method counts, status codes, and response times

wireshark_tls_analysis

TLS versions, cipher suites, and certificate info

wireshark_extract_credentials

Extract plaintext credentials observed in traffic

wireshark_check_threats

Check PCAP IPs against threat intelligence feeds

wireshark_check_ip_threat

Check a single IP against threat feeds