Network Monitor MCP Server

A server for real-time network packet monitoring and security analysis.

A Model Context Protocol (MCP) server for real-time network packet monitoring and security analysis. This tool enables Claude to inspect network traffic and identify potential security threats.

- Real-time packet capture from WiFi interfaces
- Protocol analysis (TCP, UDP, DNS, HTTP/HTTPS)
- Security threat detection:

- Port scanning detection
- Malicious DNS queries
- Data exfiltration patterns
- Anomaly detection

- capture_start- Start packet capture
- capture_stop- Stop capture
- get_packets- Retrieve and filter packets
- analyze_traffic- Traffic statistics
- get_suspicious- Security threat analysis

- Go 1.21 or higher
- libpcap development files
- Root/sudo access for packet capture

# Ubuntu/Debian sudo apt-get install libpcap-dev # RHEL/CentOS sudo yum install libpcap-devel

git clone https://github.com/skapa-xyz/network-monitor-mcp.git cd network-monitor-mcp

The server requires root privileges for packet capture:

Claude Desktop cannot directly execute commands with sudo. To use this MCP server with Claude Desktop, you have two options:

Option 1: Sudoers Configuration (NOT RECOMMENDED for production)

You can configure sudo to allow the network-monitor-mcp binary to run without a password prompt. This hasSIGNIFICANT SECURITY IMPLICATIONSand should only be done in isolated development environments where security is not a concern.

Add the following line (replace username and path):

username ALL=(ALL) NOPASSWD: /path/to/network-monitor-mcp

Update Claude Desktop configuration (~/Library/Application Support/Claude/claude_desktop_config.jsonon macOS):

{ "mcpServers": { "network-monitor": { "command": "/path/to/network-monitor-mcp" } } }

- This grants passwordless root access to the binary
- If the binary is compromised, an attacker gains root access
- Network packet capture can expose sensitive data
- Only use this in isolated development/testing environments
- Never use this configuration on production systems or machines with sensitive data

Option 2: Run Claude Desktop with elevated privileges (ALSO NOT RECOMMENDED)

You could run Claude Desktop itself with sudo, but this gives the entire application root access, which poses even greater security risks.

- Running the MCP server as a system service with proper permissions
- Using a dedicated monitoring system with appropriate access controls
- Implementing proper authentication and authorization mechanisms

Use the capture_start tool to monitor interface "en0" with a filter for TCP traffic

Use get_suspicious to show any detected security threats

Use analyze_traffic to show network statistics and connection patterns

Use get_packets to show all DNS queries or traffic to port 443

- This tool requires root access to capture packets
- Only use on networks you own or have permission to monitor
- Captured data may contain sensitive information
- The tool is designed for legitimate security monitoring in enterprise environments

network-monitor-mcp/ ├── main.go # Entry point ├── mcp/ # MCP protocol implementation │ ├── server.go # MCP server core │ └── handlers.go # Tool handlers ├── capture/ # Packet capture functionality │ ├── sniffer.go # Packet capture engine │ └── analyzer.go # Traffic analysis └── security/ # Security detection └── detector.go # Threat detection algorithms

- Ensure you're running with sudo
- Check libpcap installation

- List available interfaces:ifconfigorip link
- Common WiFi interfaces:en0(macOS),wlan0(Linux)

- Verify the interface is active
- Check your BPF filter syntax
- Ensure there's network traffic to capture
- Follow Go best practices
- Add tests for new features
- Update documentation
- Test with Claude Desktop before submitting

This project is for authorized security monitoring only. Use responsibly and in compliance with all applicable laws and regulations.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

MCP access to cluster-wide L4 and L7 network traffic, packets, APIs, and complete payloads.

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

Perform network scanning and security auditing using the NMAP utility.

Empowers LLMs with real-time network traffic analysis using tshark. Requires Wireshark's tshark to be installed.

Network diagnostics from 6 global regions — SSL, DNS, ping, whois, traceroute, port scan, latency. Works without an API key.

A server that allows MCP clients to use Suricata for network traffic analysis.

Integrate with Tailscale's CLI and API for automated network management and monitoring.

Interact with Binalyze AIR's digital forensics and incident response capabilities using natural language.

MCP server for domain monitoring — check WHOIS registration expiry via RDAP and SSL/TLS certificate expiry via crt.sh. Zero API keys, zero signup required.

Retrieves essential network information from devices using gNMI and OpenConfig models.