WireMCP

WireMCP is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with real-time network traffic analysis capabilities. By leveraging tools built on top of Wireshark'stshark, WireMCP captures and processes live network data, providing LLMs with structured context to assist in tasks like threat hunting, network diagnostics, and anomaly detection.

WireMCP exposes the following tools to MCP clients, enhancing LLM understanding of network activity:

- capture_packets: Captures live traffic and returns raw packet data as JSON, enabling LLMs to analyze packet-level details (e.g., IP addresses, ports, HTTP methods).
- get_summary_stats: Provides protocol hierarchy statistics, giving LLMs an overview of traffic composition (e.g., TCP vs. UDP usage).
- get_conversations: Delivers TCP/UDP conversation statistics, allowing LLMs to track communication flows between endpoints.
- check_threats: Captures IPs and checks them against the URLhaus blacklist, equipping LLMs with threat intelligence context for identifying malicious activity.
- check_ip_threats: Performs targeted threat intelligence lookups for specific IP addresses against multiple threat feeds, providing detailed reputation and threat data.
- analyze_pcap: Analyzes PCAP files to provide comprehensive packet data in JSON format, enabling detailed post-capture analysis of network traffic.
- extract_credentials: Scans PCAP files for potential credentials from various protocols (HTTP Basic Auth, FTP, Telnet), aiding in security audits and forensic analysis.

WireMCP bridges the gap between raw network data and LLM comprehension by:

- Contextualizing Traffic: Converts live packet captures into structured outputs (JSON, stats) that LLMs can parse and reason about.
- Threat Detection: Integrates IOCs (currently URLhaus) to flag suspicious IPs, enhancing LLM-driven security analysis.
- Diagnostics: Offers detailed traffic insights, enabling LLMs to assist with troubleshooting or identifying anomalies.
- Narrative Generation: LLM's can Transform complex packet captures into coherent stories, making network analysis accessible to non-technical users.

- Mac / Windows / Linux
- Wireshark(withtsharkinstalled and accessible in PATH)
- Node.js (v16+ recommended)
- npm (for dependency installation)

git clone https://github.com/0xkoda/WireMCP.git cd WireMCP

{ "mcpServers": { "wiremcp": { "command": "node", "args": [ "/ABSOLUTE_PATH_TO/WireMCP/index.js" ] } } }

Location (macOS):/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json

This MCP will work well with any client. Use the commandnode /path/to/WireMCP/index.jsin their MCP server settings.

Captured IPs: 174.67.0.227 52.196.136.253 Threat check against URLhaus blacklist: No threats detected in URLhaus blacklist.

{ "content": [{ "type": "text", "text": "Analyzed PCAP: ./capture.pcap\n\nUnique IPs:\n192.168.0.2\n192.168.0.1\n\nProtocols:\neth:ethertype:ip:tcp\neth:ethertype:ip:tcp:telnet\n\nPacket Data:\n[{\"layers\":{\"frame.number\":[\"1\"],\"ip.src\":[\"192.168.0.2\"],\"ip.dst\":[\"192.168.0.1\"],\"tcp.srcport\":[\"1550\"],\"tcp.dstport\":[\"23\"]}}]" }] }

- Provide natural language explanations of network activity
- Identify patterns and potential security concerns
- Offer context-aware recommendations
- Generate human-readable reports

- Expand IOC Providers: Currently uses URLhaus for threat checks. Future updates will integrate additional sources (e.g., IPsum, Emerging Threats) for broader coverage.

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

- Wireshark/tshark team for their excellent packet analysis tools
- Model Context Protocol community for the framework and specifications
- URLhaus for providing threat intelligence data

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

MCP access to cluster-wide L4 and L7 network traffic, packets, APIs, and complete payloads.

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

A server for real-time network packet monitoring and security analysis.

Perform network scanning and security auditing using the NMAP utility.

Network diagnostics from 6 global regions — SSL, DNS, ping, whois, traceroute, port scan, latency. Works without an API key.

A server that allows MCP clients to use Suricata for network traffic analysis.

Integrate with Tailscale's CLI and API for automated network management and monitoring.

Seamlessly bring real-time production context—logs, metrics, and traces—into your local environment to auto-fix code faster.

Interact with Binalyze AIR's digital forensics and incident response capabilities using natural language.

MCP server for domain monitoring — check WHOIS registration expiry via RDAP and SSL/TLS certificate expiry via crt.sh. Zero API keys, zero signup required.