Wireshark-MCP

pip install wireshark-mcp wireshark-mcp install # auto-configures all detected MCP clients

Point your AI client at a.pcapfile and try:

Analyze capture.pcap using the Wireshark MCP tools. Start with wireshark_open_file, then run wireshark_quick_analysis. Write findings to report.md.

51 tools, each backed by realtsharkoutput — organized into categories:

One tool covers 20 protocols rather than 20 tools covering one each:wireshark_analyze_protocoltakes aprotocolargument (tls_handshakes,mqtt,modbus,s7comm,zigbee,wifi,rtp,kerberos, …) and applies the right fields and display filter for it. The field names are the point —s7comm.param.item.dbnumis not something a caller should have to guess, and a wrong guess returns an empty result that reads like a clean capture.

The server starts with onlytsharkrequired. Optional tools (capinfos,mergecap,editcap,dumpcap,text2pcap) are auto-detected and enable extra features when present.

The tool list travels in the prompt prefix of every request your client sends, so its size is a fixed per-request cost. The default surface is ~21 KB — about 9 KB of parameter schema, 5 KB of descriptions, and 3 KB of read/write annotations — and it is byte-identical across restarts so clients can cache the prefix rather than re-reading it each session.

If your client never captures live traffic or writes pcaps,--profileadvertises less:

Every profile still contains every tool the bundled prompts, resources, skill files, and protocol recommendations can point the model at, so reducing the surface never leaves it chasing a tool that is not there.

Tool results are bounded too, since a result stays in the conversation for the rest of the session. Output over 8000 characters is truncated head-and-tail with a marker, and the tool'soffset/limit/display_filterparameters are the way to page through the rest. Raise or lower the ceiling with:

export WIRESHARK_MCP_MAX_RESULT_CHARS=16000

Every tool also declares whether it reads or writes, so clients can auto-approve the 40 read-only analysis tools and still prompt for the 11 that create files (live capture, merge, filter-save, editcap, text2pcap, frame extract, object export).