Sharkmcp
@kriztalz
About Sharkmcp
A tshark MCP server for packet capture and analysis
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"sharkmcp": {
"command": "node",
"args": [
"/path/to/SharkMCP/dist/index.js"
]
}
}
}Tools
No tools detected
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is SharkMCP?
SharkMCP is a Model Context Protocol (MCP) server that provides network packet capture and analysis capabilities through Wireshark/tshark integration. It is designed for AI assistants to perform network security analysis, troubleshooting, and packet inspection, particularly for debugging applications by recording traffic during test runs.
How to use SharkMCP?
Install by cloning the repository, then run pnpm install and pnpm run build. Start the server with pnpm start and configure your MCP client with the server command pointing to the built index.js. Use the tools start_capture_session, stop_capture_session, analyze_pcap_file, and manage_config to capture, analyze, and manage packet traffic.
Key features of SharkMCP
- Async background packet capture with filters and timeouts
- Analyze existing PCAP files
- Flexible output: JSON, custom fields, or text
- SSL/TLS decryption via SSL keylog files
- Reusable capture and analysis configurations
Use cases of SharkMCP
- Debugging a program by recording and inspecting its network traffic
- Network security analysis and intrusion detection
- Troubleshooting connectivity and protocol issues
- Monitoring HTTPS traffic with SSL keylog decryption
FAQ from SharkMCP
What are the system prerequisites?
Node.js version 18+, pnpm, and a working installation of Wireshark/tshark that is accessible from the command line.
How do I fix "tshark not found"?
Ensure Wireshark is installed and that tshark is in your system PATH; verify with tshark -v.
What should I do if I get "permission denied" for packet capture?
On Linux, add your user to the wireshark group or run with sudo. On macOS, grant Terminal network access in System Preferences. On Windows, run the application as Administrator.
How can I decrypt HTTPS traffic?
Set the environment variable SSLKEYLOGFILE to a file path, configure your applications to log SSL keys there, then pass that file path to the stop_capture_session tool.
What output formats does SharkMCP support?
It supports JSON, custom fields, and traditional text output, selectable via the outputFormat parameter in capture tools.
Frequently asked questions
What are the system prerequisites?
Node.js version 18+, pnpm, and a working installation of Wireshark/tshark that is accessible from the command line.
How do I fix "tshark not found"?
Ensure Wireshark is installed and that `tshark` is in your system PATH; verify with `tshark -v`.
What should I do if I get "permission denied" for packet capture?
On Linux, add your user to the `wireshark` group or run with `sudo`. On macOS, grant Terminal network access in System Preferences. On Windows, run the application as Administrator.
How can I decrypt HTTPS traffic?
Set the environment variable `SSLKEYLOGFILE` to a file path, configure your applications to log SSL keys there, then pass that file path to the `stop_capture_session` tool.
What output formats does SharkMCP support?
It supports JSON, custom fields, and traditional text output, selectable via the `outputFormat` parameter in capture tools.
Basic information
More Other MCP servers
ghidraMCP
LaurieWiredMCP Server for Ghidra
IDA Pro MCP
mrexodiaAI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
Maestro
mobile-dev-incPainless E2E Automation for Mobile and Web
DeepMark
DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.
Blender
ahujasidOpen-source MCP to use Blender with any LLM
Comments