Sharkmcp

Name: Sharkmcp
Author: kriztalz

@kriztalz

リポジトリ

Sharkmcp について

A tshark MCP server for packet capture and analysis

#wireshark #shark #tshark #pcap #pcapng #packet #monitoring

基本情報

カテゴリ

その他

トランスポート

stdio

公開者

kriztalz

投稿者

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "sharkmcp": {
      "command": "node",
      "args": [
        "/path/to/SharkMCP/dist/index.js"
      ]
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is SharkMCP?

SharkMCP is a Model Context Protocol (MCP) server that provides network packet capture and analysis capabilities through Wireshark/tshark integration. It is designed for AI assistants to perform network security analysis, troubleshooting, and packet inspection, particularly for debugging applications by recording traffic during test runs.

How to use SharkMCP?

Install by cloning the repository, then run pnpm install and pnpm run build. Start the server with pnpm start and configure your MCP client with the server command pointing to the built index.js. Use the tools start_capture_session, stop_capture_session, analyze_pcap_file, and manage_config to capture, analyze, and manage packet traffic.

Key features of SharkMCP

Async background packet capture with filters and timeouts
Analyze existing PCAP files
Flexible output: JSON, custom fields, or text
SSL/TLS decryption via SSL keylog files
Reusable capture and analysis configurations

Use cases of SharkMCP

Debugging a program by recording and inspecting its network traffic
Network security analysis and intrusion detection
Troubleshooting connectivity and protocol issues
Monitoring HTTPS traffic with SSL keylog decryption

FAQ from SharkMCP

What are the system prerequisites?

Node.js version 18+, pnpm, and a working installation of Wireshark/tshark that is accessible from the command line.

How do I fix "tshark not found"?

Ensure Wireshark is installed and that tshark is in your system PATH; verify with tshark -v.

What should I do if I get "permission denied" for packet capture?

On Linux, add your user to the wireshark group or run with sudo. On macOS, grant Terminal network access in System Preferences. On Windows, run the application as Administrator.

How can I decrypt HTTPS traffic?

Set the environment variable SSLKEYLOGFILE to a file path, configure your applications to log SSL keys there, then pass that file path to the stop_capture_session tool.