A tshark MCP server for packet capture and analysis
Features:
Async: your agent can run a curl command and get the packets for it
Flexible: You choose the capture and display filters
Config: You can reuse the display and capture filters
Overview
What is SharkMCP?
SharkMCP is a Model Context Protocol (MCP) server designed for network packet capture and analysis, integrating with Wireshark/tshark to facilitate network security analysis, troubleshooting, and packet inspection.
How to use SharkMCP?
To use SharkMCP, clone the repository, install dependencies, and run the server. You can start a packet capture session, run your tool or request, and then stop the capture to analyze the results.
Key features of SharkMCP?
- Async packet capture with configurable filters
- Analyze existing PCAP files
- Flexible output formats (JSON, custom fields, text)
- SSL/TLS decryption support
- Reusable configurations for capture and analysis
Use cases of SharkMCP?
- Debugging programs by capturing and analyzing network requests.
- Monitoring HTTPS traffic and decrypting it for analysis.
- Performing network security assessments and troubleshooting network issues.
FAQ from SharkMCP?
- What are the system requirements?
Wireshark/tshark must be installed, along with Node.js (version 18+) and pnpm as the package manager.
- How do I install SharkMCP?
Clone the repository, install dependencies, build the project, and run the server.
- Can I use SharkMCP for real-time packet analysis?
Yes, SharkMCP allows for real-time packet capture and analysis.
Server Config
{
"mcpServers": {
"sharkmcp": {
"command": "node",
"args": [
"/path/to/SharkMCP/dist/index.js"
]
}
}
}