Wireshark

Wireshark MCP lets AI assistants access and analyze live network traffic and pcaps through a standard Model Context Protocol server. It bridges raw packet data and AI insights, enabling you to summarize traffic, inspect protocols, and explore flows directly from your MCP client.

How to use

You run the Wireshark MCP server locally and connect an MCP client to it to query network analysis capabilities. The server exposes a stdio transport for seamless integration with clients like Claude Desktop, and it can be run over a network transport when you need a dedicated HTTP/SSE channel.

How to install

Prerequisites: Python 3.8 or newer, and Wireshark/tshark installed and available in your system PATH.

Step 1: Clone the project and install dependencies.

# Clone the repository
git clone https://github.com/sarthaksiddha/Wireshark-mcp.git
cd Wireshark-mcp

# Install dependencies in editable mode
pip install -e .

Configuration and usage notes

To run the MCP server locally using stdio transport (recommended for Claude Desktop integration), start the server with the following command. This keeps the server running in the same process space as your client and avoids network plumbing.

python mcp_server.py --stdio

If you prefer to run the server over a network transport (SSE/http) for other MCP clients, you can start the server on a specific host and port.

python mcp_server.py --host 127.0.0.1 --port 5000

Notes on configuration with Claude Desktop

If you want Claude Desktop to invoke the Wireshark MCP server, configure it to launch the local stdio-based server. You provide the Python command and the script path as part of the client’s configuration.

{
  "mcpServers": {
    "wireshark": {
      "command": "python",
      "args": [
        "/path/to/wireshark-mcp/mcp_server.py",
        "--stdio"
      ]
    }
  }
}

Examples of practical usage

Use cases you can perform through the server include capturing live traffic, analyzing pcap files, and querying protocol-specific insights. You can ask for packet summaries, flow tracking, and anomaly highlights, or request a protocol-aware analysis focused on HTTP, DNS, TLS, SMTP, and other common protocols.

Available tools

capture_live_traffic

Capture live network traffic using tshark to generate contextual data for AI analysis.

analyze_pcap

Analyze an existing pcap file and extract structured, protocol-aware summaries.

get_protocol_list

Provide a list of supported protocols available for analysis.