bx33661/Wireshark-MCP

Wireshark-MCP，Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

What it solves

Wireshark MCP bridges the gap between raw network traffic analysis and AI-assisted investigation. It allows AI agents (like those in Claude Desktop, Cursor, or VS Code) to interact directly with .pcap files and the Wireshark suite, enabling users to ask plain-English questions about network captures instead of manually navigating complex packet analysis interfaces.

How it works

This project implements a Model Context Protocol (MCP) server that acts as a wrapper for tshark (the command-line version of Wireshark). When connected to an MCP-compatible client, the server exposes over 50 specialized tools that the AI can call to perform tasks like packet extraction, protocol analysis, statistical aggregation, and security anomaly detection. The server handles the translation between natural language requests and the specific command-line arguments required by tshark.

Who it’s for

It is designed for security analysts, network engineers, and developers who want to use LLMs to automate the tedious parts of network forensics, such as identifying suspicious DNS queries, scanning for credentials, or analyzing protocol-specific traffic patterns.

Highlights

  • Extensive Toolset: Includes 52 tools covering everything from basic file opening and packet inspection to advanced security analysis like port scanning, beaconing detection, and TLS decryption.
  • Protocol Versatility: Features a unified wireshark_analyze_protocol tool that handles 25+ protocols, including industrial and IoT standards like Modbus, S7comm, and Zigbee.
  • Configurable Profiles: Offers different operational profiles (full, analysis, core) to manage the size of the tool definitions sent to the AI, optimizing context window usage.
  • Security-Focused: Implements read/write permissions for tools, ensuring that potentially destructive actions (like file writing or live capture) are controlled and restricted to allowed directories.

Related

  • Project
    adobe-research/dynasaur

    DynaSaur is an AI agent framework that writes and reuses Python code as actions to solve tasks, adapting dynamically when predefined tools are insufficient.

  • Project
    Hy4ri/hermes-mobile

    Hermes Mobile is a native Android companion app that allows you to remotely chat with, configure, and manage your Hermes AI agent dashboard.

  • Project
    chemark/ai-agent-book

    This open-source book teaches AI agent engineering through a 10-chapter progression from fundamentals to advanced topics like multi-agent collaboration, with 92 hands-on experiments and full source code. It covers the core formula Agent = LLM + context + tools, along with practical guidance on context engineering, tool use, evaluation, and post-training.

  • Project
    dezgit2025/auto-memory

    auto‑memory is a zero‑dependency CLI that reads the local SQLite session stores used by AI coding assistants (GitHub Copilot CLI, Claude Code, Codex). It checks schema compatibility, offers pre‑bundled or AI‑assisted repairs when the store format changes, and lets users query recent sessions with only ~50 tokens. Install via pipx/uv, then run `session-recall` (or backend‑specific commands) to restore an agent’s memory without re‑prompting.