Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
{
"mcpServers": {
"io-github-bx33661-wireshark-mcp": {
"args": [
"wireshark-mcp"
],
"command": "uvx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
Is it safe?
No known CVEs for wireshark-mcp.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 9 days ago. 85 stars.
Will it work with my client?
Transport: stdio, sse, http. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'wireshark-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
No known vulnerabilities.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationHave you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Search, evaluate, and compare 17,000+ MCP servers — each scored on security, maintenance, and efficiency.
AI agents get on-chain identity, credentials, reputation, escrow, and persistent memory on XRPL.
MCP server for scanning and remediating hardcoded secrets using GitGuardian’s API. Detect over 500 secret types and prevent credential leaks before code goes public.
956k Swiss court decisions: full-text search, citation graph, statute lookup (DE/FR/IT)
MCP Security Weekly
Get CVE alerts and security updates for io.github.bx33661/wireshark-mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Give your AI assistant a packet analyzer.
Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
English · 中文 · Changelog · Contributing
Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities such as capinfos, mergecap, editcap, dumpcap, and text2pcap when they are available. The result is a packet-analysis server that still works with only tshark, but gets stronger automatically on hosts with more of the Wireshark toolchain installed.
You: "Find all DNS queries going to suspicious domains in this capture."
Claude: [calls wireshark_extract_dns_queries → wireshark_check_threats]
"Found 3 queries to domains flagged by URLhaus: ..."
tsharktshark is the only required Wireshark CLI dependencycapinfos, mergecap, editcap, dumpcap, and text2pcap are auto-detected and enable extra MCP features when presentdumpcap when available, but falls back to tshark so a minimal installation still workstshark on your PATH is recommended, but wireshark-mcp install also records detected absolute Wireshark tool paths for GUI clientsFor v1.0, "stable" means the project commits to the following baseline:
| Area | v1.0 baseline |
|---|---|
| Operating systems | Windows, Linux, and macOS |
| CI validation | Test suite runs on all three platforms; packaged CLI smoke tests run on all three platforms; real tshark integration smoke runs on Linux |
| Python versions | 3.10, 3.11, 3.12, 3.13 |
| Required Wireshark dependency | tshark |
| Optional Wireshark suite tools | capinfos, mergecap, editcap, dumpcap, text2pcap auto-detected when present |
| Supported install paths | pip install wireshark-mcp, source install, and manual MCP config snippets |
| User-facing verification | wireshark-mcp doctor, wireshark-mcp clients, and wireshark-mcp config |
If one of these baseline items stops working, that is a 1.0.x bug, not a "future enhancement".
Play or download the install demo video
Play or download the analysis demo video
[![In