A Rust-based MCP server for AI-driven network forensics. Analyzes PCAP files and live traffic with analyst-grade reasoning.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"pcap-mcp-server": {
"command": "<see-readme>",
"args": []
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
A Model Context Protocol (MCP) server written in Rust for network traffic analysis. It allows AI models like Claude to inspect PCAP files and live network traffic directly through a set of specialized tools.
No automated test available for this server. Check the GitHub README for setup instructions.
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
No package registry to scan.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in ai-ml
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
Dynamic problem-solving through sequential thought chains
A Model Context Protocol server for searching and analyzing arXiv papers
The official Python SDK for Model Context Protocol servers and clients
MCP Security Weekly
Get CVE alerts and security updates for Pcap Mcp Server and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
A Model Context Protocol (MCP) server written in Rust for network traffic analysis. It allows AI models like Claude to inspect PCAP files and live network traffic directly through a set of specialized tools.
.pcap/.pcapng files or capture live traffic from network interfaces.etherparse and libpcap.The easiest way to install and configure pcap-mcp-server is using the intelligent setup script. It handles the entire process:
# 1. Clone the repository
git clone https://github.com/SiberTutor/pcap-mcp-server
cd pcap-mcp-server
# 2. Run the auto-installer
python3 setup.py
After the script finishes, restart Claude Desktop (if you use it) and you're ready to go!
If you prefer to handle dependencies and configuration yourself:
Before installing, ensure you have Git, Rust (1.75+), and libpcap headers on your system.
sudo apt-get update && sudo apt-get install libpcap-devsudo dnf install libpcap-develxcode-select --install (libpcap is included)cargo build --release
The compiled binary will be created at: target/release/pcap-mcp-server
To allow the server to capture traffic without sudo:
# Linux
sudo setcap cap_net_raw,cap_net_admin=eip target/release/pcap-mcp-server
If you didn't use the script, add the full path of the binary to your configuration:
claude_desktop_config.json.claude mcp add pcap-mcp <FULL_PATH_TO_BINARY>.| Category | Tools |
|---|---|
| Basics | analyze_metadata, list_packets, inspect_payload, list_interfaces |
| Security | security_scan, monitor_and_scan, analyze_attack_narrative |
| Analysis | reconstruct_flows, follow_stream, dns_timeline, extract_files |
| Utilities | pcap_slice, sampling, export_report, capture_live_traffic |
Supports a subset of BPF-like syntax:
tcp, udp, icmp, dns, http, httpshost 10.0.0.1, src host 192.168.1.1port 80, dst port 443and, or, notMIT