Advertise
MCP.so
Sign In

mcpcap MCP Server

@mcpcap

Repository

Basic information

Category

Other

Last updated

Transports

stdio

Author

mcpcap

Submitted by

danohn

About mcpcap MCP Server

A modular Python MCP (Model Context Protocol) Server for analyzing PCAP files. mcpcap enables LLMs to read and analyze network packet captures with protocol-specific analysis tools that accept local file paths or remote URLs as parameters (no file uploads - provide the path or UR

#pcap#network#analysis

mcpcap MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcpcap": {
      "command": "uvx",
      "args": [
        "mcpcap"
      ]
    }
  }
}

mcpcap MCP Server tools

4

Analyze DNS packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DNS packet analysis results

Analyze DHCP packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DHCP packet analysis results

Analyze ICMP packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing ICMP packet analysis results

Return metadata from a PCAP file, similar to Wireshark's capinfos utility. IMPORTANT: This tool expects a FILE PATH or URL, not file content. - For local files: "/path/to/capture.pcap" - For remote files: "https://example.com/capture.pcap" - File uploads are NOT supported - save the file locally first Args: pcap_file: Path to local PCAP file or HTTP URL to remote PCAP file (NOT file content - must be a path or URL) Returns: A structured dictionary containing PCAP metadata including: - File information (size, name, encapsulation type) - Packet statistics (count, data size, average sizes) - Temporal data (duration, timestamps, rates)

Overview

What is mcpcap?

A modular Python MCP (Model Context Protocol) server for analyzing PCAP files. It enables LLMs to read and analyze network packet captures using protocol-specific analysis tools that accept local file paths or remote URLs as parameters (no file uploads).

How to use mcpcap?

Install with pip install mcpcap, uv add mcpcap, or run with uvx mcpcap. Start the server by running mcpcap (optionally with --modules and --max-packets flags). Configure an MCP client (e.g., Claude Desktop) with {"mcpServers": {"mcpcap": {"command": "mcpcap", "args": []}}}. Then call tools like analyze_dns_packets("/path/to/file.pcap") or analyze_dns_packets("https://example.com/remote.pcap").

Key features of mcpcap

  • Stateless MCP tools accepting file paths or URLs
  • Modular architecture with DNS, DHCP, ICMP, and CapInfos modules
  • Supports local files and HTTP/HTTPS remote PCAPs
  • Leverages scapy for comprehensive packet parsing
  • Offers specialized analysis prompts (security, networking, forensics)
  • Returns structured JSON responses for LLM consumption

Use cases of mcpcap

  • Analyze DNS traffic to detect potential security threats or performance issues
  • Examine DHCP handshakes to audit IP address assignments and rogue servers
  • Investigate ICMP traffic for network connectivity and path analysis
  • Extract PCAP metadata and statistics similar to Wireshark’s capinfos
  • Perform forensic investigation with timeline reconstruction from captured packets

Frequently asked questions

1

What are the runtime requirements?

Python 3.10 or greater, plus the scapy, requests, and fastmcp libraries.

2

Can mcpcap analyze remote PCAP files?

Yes. Both analysis tools accept HTTP/HTTPS URLs. Files are downloaded automatically to a temporary location and cleaned up after analysis.

3

How can I limit the number of packets analyzed?

Use the `--max-packets N` CLI flag when starting the server (e.g., `mcpcap --max-packets 1000`).

4

Which protocol modules are available and how do I select them?

Available modules are `dns`, `dhcp`, `icmp`, and `capinfos`. Use `--modules dns,dhcp,icmp,capinfos` to load specific ones; the default loads all four.

5

Are there security considerations when using mcpcap?

PCAP files may contain sensitive network information. Remote downloads use HTTPS when possible, and temporary files are cleaned up automatically. Always consider the source and trustworthiness of remote files.

Comments

More Other MCP servers

YOUB

Connect your AI assistant to your own YOUB endurance training account. Read recorded activities with full analysis, planned sessions, race goals, wellness (HRV, sleep, resting HR) and your athletic profile. Create or mov

Volley.sh

Volley

A good sequence diagram can solve almost any communication problem in engineering. Volley lets your agent write them as plain text, with the real request and response payloads on every arrow. It checks its own syntax wi

Handl

Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.

Klarix Intelligence Engine

Klarix

B2B competitive intelligence, live sales battlecards, 5-axis ICP prospect fit scoring, and tech stack teardowns over MCP and REST with cited public-web evidence.

Figs, Relationship Expert

Figs O'Sullivan, LMFT

Couples therapist Figs O'Sullivan (LMFT, 17 years, endorsed by Sue Johnson, creator of EFT) inside your AI. Ask relationship questions answered from his clinical writing, name the pattern in a fight, get a three-step rep

Advertise