mcpcap

by mcpcap

324 downloads

Not rated

GitHub

Other

About

A modular Python MCP (Model Context Protocol) Server for analyzing PCAP files. mcpcap enables LLMs to read and analyze network packet captures with protocol-specific analysis tools that accept local file paths or remote URLs as parameters (no file uploads - provide the path or UR

Details

Author: mcpcap
Downloads: 324
Categories: Other

- Stateless MCP tools accepting file paths or URLs
- Modular architecture with DNS, DHCP, ICMP, and CapInfos modules
- Supports local files and HTTP/HTTPS remote PCAPs
- Leverages scapy for comprehensive packet parsing
- Offers specialized analysis prompts (security, networking, forensics)
- Returns structured JSON responses for LLM consumption

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name mcpcap

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

From the repository

Install with pip install mcpcap, uv add mcpcap, or run with uvx mcpcap. Start the server by running mcpcap (optionally with --modules and --max-packets flags). Configure an MCP client (e.g., Claude Desktop) with {"mcpServers": {"mcpcap": {"command": "mcpcap", "args": []}}}. Then call tools like analyze_dns_packets("/path/to/file.pcap") or analyze_dns_packets("https://example.com/remote.pcap").

`analyze_dns_packets`

Analyze DNS packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DNS packet analysis results

`analyze_dhcp_packets`

Analyze DHCP packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DHCP packet analysis results

`analyze_icmp_packets`

Analyze ICMP packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing ICMP packet analysis results

`analyze_capinfos`

Return metadata from a PCAP file, similar to Wireshark's capinfos utility. IMPORTANT: This tool expects a FILE PATH or URL, not file content. - For local files: "/path/to/capture.pcap" - For remote files: "https://example.com/capture.pcap" - File uploads are NOT supported - save the file locally first Args: pcap_file: Path to local PCAP file or HTTP URL to remote PCAP file (NOT file content - must be a path or URL) Returns: A structured dictionary containing PCAP metadata including: - File information (size, name, encapsulation type) - Packet statistics (count, data size, average sizes) - Temporal data (duration, timestamps, rates)

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "mcpcap": {
            "mcpcap": {
                "command": "uvx",
                "args": [
                    "mcpcap"
                ]
            }
        }
    }
}

McpServers

{
    "mcpcap": {
        "command": "uvx",
        "args": [
            "mcpcap"
        ]
    }
}

mcpcap

Overview

mcpcap uses a modular architecture to analyze different network protocols found in PCAP files. Each module provides specialized analysis tools that can be called independently with any PCAP file, making it perfect for integration with Claude Desktop and other MCP clients.

Key Features

- Stateless MCP Tools: Each analysis accepts PCAP file paths or URLs as parameters (no file uploads) - Modular Architecture: DNS, DHCP, ICMP, and CapInfos modules with easy extensibility for new protocols - Local & Remote PCAP Support: Analyze files from local storage or HTTP URLs - Scapy Integration: Leverages scapy's comprehensive packet parsing capabilities - Specialized Analysis Prompts: Security, networking, and forensic analysis guidance - JSON Responses: Structured data format optimized for LLM consumption

Installation

mcpcap requires Python 3.10 or greater.

Using pip

bash
pip install mcpcap



Using uv

bash
uv add mcpcap



Using uvx (for one-time usage)

bash
uvx mcpcap



Quick Start


1. Start the MCP Server


Start mcpcap as a stateless MCP server:

``bash

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

analyze_dns_packets

analyze_dhcp_packets

analyze_icmp_packets

analyze_capinfos

Claude Desktop / Cursor

McpServers

mcpcap

Overview

Key Features

Installation

Using pip

Using uv

Using uvx (for one-time usage)

Quick Start

1. Start the MCP Server

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Reactive Resume

FastMCP v2 🚀

`analyze_dns_packets`

`analyze_dhcp_packets`

`analyze_icmp_packets`

`analyze_capinfos`