MCP Wireshark

@khuynh22

About MCP Wireshark

An MCP server that integrates Wireshark/tshark with AI tools and IDEs. Capture live traffic, parse .pcap files, apply display filters, follow streams, and export JSON - all via Claude Desktop, VS Code, or CLI. Cross‑platform, typed, tested, and pip‑installable.

#wireshark #tshark #network #pcap #packet-capture #network-analysis #security #iec61850

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "wireshark": {
      "command": "mcp-wireshark",
      "args": []
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is MCP Wireshark?

MCP Wireshark is a community-maintained MCP server that gives AI assistants direct access to Wireshark/tshark packet captures. It allows users to summarize .pcap files, follow TCP streams, filter for specific protocols, and capture live traffic without leaving the chat.

How to use MCP Wireshark?

Install the package with pip install mcp-wireshark and add it to Claude Code using claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark. The server works with any MCP client (Claude Desktop, VS Code, Cursor, etc.) and requires tshark to be installed and on the system PATH.

Key features of MCP Wireshark

14 tools split into read and write categories
Read tools: summarize_pcap, display_filter, follow_tcp/udp, expert_info, decode_protocol, analyze_iec61850, and more
Write tools: live_capture (capped at 5 min / 10k packets) and export_json
All read tools annotated with MCP readOnlyHint for safety
Security: file path validation, no shell metacharacters, no shell=True, hard caps on packets and time
Supports IEC 61850 analysis (GOOSE, SV, MMS)

Use cases of MCP Wireshark

Summarize an unknown packet capture to see I/O stats, protocol hierarchy, and top talkers
Follow a TCP or UDP stream and extract its payload
Filter a capture with Wireshark display filters for specific protocols (HTTP, DNS, TLS, etc.)
Capture live traffic from a network interface with a display filter
Export packets from a pcap to a JSON file for further analysis

FAQ from MCP Wireshark

What prerequisites are required to run MCP Wireshark?

Python 3.10+ and Wireshark installed with tshark reachable on the system PATH.

How can I verify the installation?

Inside Claude Code, ask the assistant to "Run check_installation." If tshark is on the PATH, it returns the version.

How do I capture live traffic with MCP Wireshark?

Use the live_capture tool. It captures traffic from a specified interface, capped at 5 minutes or 10,000 packets, and can be combined with a display filter.

What should I do if `tshark` is not found on Windows?

Add the Wireshark installation directory (e.g., C:\Program Files\Wireshark) to the system PATH environment variable, then restart the terminal and Claude Code.

Does MCP Wireshark support IEC 61850 protocols?

Yes, the analyze_iec61850 tool provides health triage for GOOSE, SV, and MMS captures, including gap detection, TTL violations, and MMS errors.

Frequently asked questions

What prerequisites are required to run MCP Wireshark?

Python 3.10+ and Wireshark installed with `tshark` reachable on the system `PATH`.

How can I verify the installation?

Inside Claude Code, ask the assistant to "Run check_installation." If `tshark` is on the `PATH`, it returns the version.

How do I capture live traffic with MCP Wireshark?

Use the `live_capture` tool. It captures traffic from a specified interface, capped at 5 minutes or 10,000 packets, and can be combined with a display filter.

What should I do if `tshark` is not found on Windows?

Add the Wireshark installation directory (e.g., `C:\Program Files\Wireshark`) to the system `PATH` environment variable, then restart the terminal and Claude Code.

Does MCP Wireshark support IEC 61850 protocols?

Yes, the `analyze_iec61850` tool provides health triage for GOOSE, SV, and MMS captures, including gap detection, TTL violations, and MMS errors.

Comments

Basic information

More Other MCP servers

Peekaboo MCP – lightning-fast macOS screenshots for AI agents

steipete

Peekaboo is a macOS CLI & optional MCP server that enables AI agents to capture screenshots of applications, or the entire system, with optional visual question answering through local or remote AI models.

4.8K

Maestro

mobile-dev-inc

Painless E2E Automation for Mobile and Web

14.8K

Unity MCP ✨

justinpbarnett

Unity MCP acts as a bridge between AI assistants and your Unity Editor. Give your LLM tools to manage assets, control scenes, edit scripts, and automate tasks within Unity.

12.2K