What are the runtime dependencies?
Requires Node.js v16+, Wireshark/tshark in PATH, and npm for dependency management. Works on Windows, macOS, and Linux.
Netforensicmcp MCP Server
@kylecui
Basic information
About Netforensicmcp MCP Server
NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analys
Netforensicmcp MCP Server config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"NetForensicMCP": {
"command": "node",
"args": [
"index.js"
]
}
}
}Netforensicmcp MCP Server tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is NetForensicMCP?
NetForensicMCP (formerly WireMCP) is a Model Context Protocol (MCP) server that empowers LLMs with offline network traffic analysis and threat intelligence capabilities. Built on Wireshark's tshark, it provides PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.
How to use NetForensicMCP?
Install Node.js (v16+), Wireshark (tshark in PATH), and clone the repository. Run npm install then node index.js. Configure an MCP client (e.g., Cursor IDE or Claude Desktop) with the path to index.js and the command node.
Key features of NetForensicMCP
- Smart stream analysis with intelligent chunking for large PCAPs
- Threat intelligence integration with URLhaus blacklist checking
- Automated credential extraction across multiple protocols
- High-frequency IP analysis for proactive threat hunting
- Paginated stream content extraction and size estimation
- Legacy live traffic capture for compatibility
Use cases of NetForensicMCP
- Threat hunting: proactive identification of APT activities and C2 communications
- Incident response: rapid forensic analysis of network evidence
- Compliance auditing: credential leak detection and security gap identification
- IOC extraction: automated indicator of compromise discovery
- Attack reconstruction: timeline analysis and attack path visualization
Frequently asked questions
How does NetForensicMCP handle large PCAP files?
It uses intelligent chunking with pagination support, content size estimation, and automated stream segmentation to prevent token overflow.
Where does threat intelligence data come from?
Built-in integration with URLhaus (abuse.ch) for comprehensive malware URL database checking.
Does NetForensicMCP support live traffic capture?
Legacy `capture_packets` tool is preserved for compatibility, but the focus is on offline forensic analysis.
How is the server configured for different MCP clients?
For Cursor IDE, edit `mcp.json` with the path to index.js. For Claude Desktop, edit the appropriate config file (macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`, Windows: `%APPDATA%\Claude\claude_desktop_config.json`).
More Other MCP servers
Maestro
mobile-dev-incPainless E2E Automation for Mobile and Web
14.8K
Yuppsy
Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code
YOUB
Connect your AI assistant to your own YOUB endurance training account. Read recorded activities with full analysis, planned sessions, race goals, wellness (HRV, sleep, resting HR) and your athletic profile. Create or mov
Soar Flight Booking MCP
Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.
FastMCP v2 🚀
jlowin🚀 The fast, Pythonic way to build MCP servers and clients.
26.0K
Comments