MCP.so
Sign In

Netforensicmcp

@kylecui

Repository

About Netforensicmcp

NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analys

#wireshark#security#threathunters#threatintelligence#cybersecurity

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "NetForensicMCP": {
      "command": "node",
      "args": [
        "index.js"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is NetForensicMCP?

NetForensicMCP (formerly WireMCP) is a Model Context Protocol (MCP) server that empowers LLMs with offline network traffic analysis and threat intelligence capabilities. Built on Wireshark's tshark, it provides PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.

How to use NetForensicMCP?

Install Node.js (v16+), Wireshark (tshark in PATH), and clone the repository. Run npm install then node index.js. Configure an MCP client (e.g., Cursor IDE or Claude Desktop) with the path to index.js and the command node.

Key features of NetForensicMCP

  • Smart stream analysis with intelligent chunking for large PCAPs
  • Threat intelligence integration with URLhaus blacklist checking
  • Automated credential extraction across multiple protocols
  • High-frequency IP analysis for proactive threat hunting
  • Paginated stream content extraction and size estimation
  • Legacy live traffic capture for compatibility

Use cases of NetForensicMCP

  • Threat hunting: proactive identification of APT activities and C2 communications
  • Incident response: rapid forensic analysis of network evidence
  • Compliance auditing: credential leak detection and security gap identification
  • IOC extraction: automated indicator of compromise discovery
  • Attack reconstruction: timeline analysis and attack path visualization

FAQ from NetForensicMCP

What are the runtime dependencies?

Requires Node.js v16+, Wireshark/tshark in PATH, and npm for dependency management. Works on Windows, macOS, and Linux.

How does NetForensicMCP handle large PCAP files?

It uses intelligent chunking with pagination support, content size estimation, and automated stream segmentation to prevent token overflow.

Where does threat intelligence data come from?

Built-in integration with URLhaus (abuse.ch) for comprehensive malware URL database checking.

Does NetForensicMCP support live traffic capture?

Legacy capture_packets tool is preserved for compatibility, but the focus is on offline forensic analysis.

How is the server configured for different MCP clients?

For Cursor IDE, edit mcp.json with the path to index.js. For Claude Desktop, edit the appropriate config file (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json, Windows: %APPDATA%\Claude\claude_desktop_config.json).

Frequently asked questions

What are the runtime dependencies?

Requires Node.js v16+, Wireshark/tshark in PATH, and npm for dependency management. Works on Windows, macOS, and Linux.

How does NetForensicMCP handle large PCAP files?

It uses intelligent chunking with pagination support, content size estimation, and automated stream segmentation to prevent token overflow.

Where does threat intelligence data come from?

Built-in integration with URLhaus (abuse.ch) for comprehensive malware URL database checking.

Does NetForensicMCP support live traffic capture?

Legacy `capture_packets` tool is preserved for compatibility, but the focus is on offline forensic analysis.

How is the server configured for different MCP clients?

For Cursor IDE, edit `mcp.json` with the path to index.js. For Claude Desktop, edit the appropriate config file (macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`, Windows: `%APPDATA%\Claude\claude_desktop_config.json`).

Comments

Basic information

Category

Other

Transports

stdio

Author

kylecui

Submitted by

Kyle Cui

More Other MCP servers

Peekaboo MCP – lightning-fast macOS screenshots for AI agents

steipete

Peekaboo is a macOS CLI & optional MCP server that enables AI agents to capture screenshots of applications, or the entire system, with optional visual question answering through local or remote AI models.

4.8K

XcodeBuildMCP

cameroncooke

A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

6.0K

Unity MCP ✨

justinpbarnett

Unity MCP acts as a bridge between AI assistants and your Unity Editor. Give your LLM tools to manage assets, control scenes, edit scripts, and automate tasks within Unity.

12.2K

ICSS

chokcoco

不止于 CSS

20.7K

ACI: Open-Source Infra to Power Unified MCP Servers

aipotheosis-labs

ACI.dev is the open source tool-calling platform that hooks up 600+ tools into any agentic IDE or custom AI agent through direct function calling or a unified MCP server. The birthplace of VibeOps.

4.8K