mcpcap

What is mcpcap?

A modular Python MCP (Model Context Protocol) server for analyzing PCAP files. It enables LLMs to read and analyze network packet captures using protocol-specific analysis tools that accept local file paths or remote URLs as parameters (no file uploads).

How to use mcpcap?

Install with pip install mcpcap, uv add mcpcap, or run with uvx mcpcap. Start the server by running mcpcap (optionally with --modules and --max-packets flags). Configure an MCP client (e.g., Claude Desktop) with {"mcpServers": {"mcpcap": {"command": "mcpcap", "args": []}}}. Then call tools like analyze_dns_packets("/path/to/file.pcap") or analyze_dns_packets("https://example.com/remote.pcap").

Key features of mcpcap

• Stateless MCP tools accepting file paths or URLs
• Modular architecture with DNS, DHCP, ICMP, and CapInfos modules
• Supports local files and HTTP/HTTPS remote PCAPs
• Leverages scapy for comprehensive packet parsing
• Offers specialized analysis prompts (security, networking, forensics)
• Returns structured JSON responses for LLM consumption

Use cases of mcpcap

• Analyze DNS traffic to detect potential security threats or performance issues
• Examine DHCP handshakes to audit IP address assignments and rogue servers
• Investigate ICMP traffic for network connectivity and path analysis
• Extract PCAP metadata and statistics similar to Wireshark’s capinfos
• Perform forensic investigation with timeline reconstruction from captured packets

FAQ from mcpcap

What are the runtime requirements?

Python 3.10 or greater, plus the scapy, requests, and fastmcp libraries.

Can mcpcap analyze remote PCAP files?

Yes. Both analysis tools accept HTTP/HTTPS URLs. Files are downloaded automatically to a temporary location and cleaned up after analysis.

How can I limit the number of packets analyzed?

Use the --max-packets N CLI flag when starting the server (e.g., mcpcap --max-packets 1000).

Which protocol modules are available and how do I select them?

Available modules are dns, dhcp, icmp, and capinfos. Use --modules dns,dhcp,icmp,capinfos to load specific ones; the default loads all four.

Are there security considerations when using mcpcap?

PCAP files may contain sensitive network information. Remote downloads use HTTPS when possible, and temporary files are cleaned up automatically. Always consider the source and trustworthiness of remote files.