Sharkmcp

Name: Sharkmcp
Author: kriztalz

@kriztalz

Repository

About Sharkmcp

A tshark MCP server for packet capture and analysis

#wireshark #shark #tshark #pcap #pcapng #packet #monitoring

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "sharkmcp": {
      "command": "node",
      "args": [
        "/path/to/SharkMCP/dist/index.js"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is SharkMCP?

SharkMCP is a Model Context Protocol (MCP) server that provides network packet capture and analysis capabilities through Wireshark/tshark integration. It is designed for AI assistants to perform network security analysis, troubleshooting, and packet inspection, particularly for debugging applications by recording traffic during test runs.

How to use SharkMCP?

Install by cloning the repository, then run pnpm install and pnpm run build. Start the server with pnpm start and configure your MCP client with the server command pointing to the built index.js. Use the tools start_capture_session, stop_capture_session, analyze_pcap_file, and manage_config to capture, analyze, and manage packet traffic.

Key features of SharkMCP

Async background packet capture with filters and timeouts
Analyze existing PCAP files
Flexible output: JSON, custom fields, or text
SSL/TLS decryption via SSL keylog files
Reusable capture and analysis configurations

Use cases of SharkMCP

Debugging a program by recording and inspecting its network traffic
Network security analysis and intrusion detection
Troubleshooting connectivity and protocol issues
Monitoring HTTPS traffic with SSL keylog decryption

FAQ from SharkMCP

What are the system prerequisites?

Node.js version 18+, pnpm, and a working installation of Wireshark/tshark that is accessible from the command line.

How do I fix "tshark not found"?

Ensure Wireshark is installed and that tshark is in your system PATH; verify with tshark -v.

What should I do if I get "permission denied" for packet capture?

On Linux, add your user to the wireshark group or run with sudo. On macOS, grant Terminal network access in System Preferences. On Windows, run the application as Administrator.

How can I decrypt HTTPS traffic?

Set the environment variable SSLKEYLOGFILE to a file path, configure your applications to log SSL keys there, then pass that file path to the stop_capture_session tool.