Wireshark MCP Server

What is Wireshark MCP Server?

Wireshark MCP Server exposes PyShark functionality through the Model Context Protocol (MCP), allowing AI assistants like Claude to interact with network packet capture and analysis capabilities.

How to use Wireshark MCP Server?

Install dependencies with uv add mcp[cli] pyshark or pip install mcp[cli] pyshark, clone the repository, then run the server in development mode with mcp dev pyshark_mcp.py or install it in Claude Desktop with mcp install pyshark_mcp.py.

Key features of Wireshark MCP Server

• Lists available network interfaces
• Captures live packets from a network interface
• Reads and analyzes packet capture (pcap) files
• Analyzes network traffic patterns from captures
• Captures targeted traffic by host, port, or protocol
• Detects and reports network protocols in use
• Provides capture history and configuration resources

Use cases of Wireshark MCP Server

• An AI assistant checking available network interfaces before a capture
• Capturing live HTTP traffic for a specified duration
• Analyzing a previously saved pcap file to extract insights
• Detecting network protocols and patterns in a traffic capture

FAQ from Wireshark MCP Server

What does Wireshark MCP Server do?

It is an MCP server that wraps PyShark to let AI assistants (e.g., Claude) perform live packet captures, read pcap files, analyze traffic, and list interfaces.

What are the runtime requirements?

Python 3.8+, TShark (Wireshark’s command-line component) installed separately, and administrative/root privileges for live packet capture.

How do I run or install the server?

Use mcp dev pyshark_mcp.py for development mode with the MCP Inspector, or mcp install pyshark_mcp.py to install it directly in Claude Desktop.

What permissions are needed?

Network packet capture often requires administrative/root privileges, and users must have authorization to capture traffic and comply with applicable laws.

Can I extend the server’s functionality?

Yes, by adding more advanced capture/analysis tools, implementing filters, creating specialized protocol analysis functions, or extending the capture history.