Netforensicmcp MCP Server

@kylecui

代码仓库

基本信息

分类

其他

传输方式

stdio

作者

kylecui

提交者

Kyle Cui

关于 Netforensicmcp MCP Server

NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analys

#wireshark #security#threathunters#threatintelligence#cybersecurity

Netforensicmcp MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "NetForensicMCP": {
      "command": "node",
      "args": [
        "index.js"
      ]
    }
  }
}

Netforensicmcp MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is NetForensicMCP?

NetForensicMCP (formerly WireMCP) is a Model Context Protocol (MCP) server that empowers LLMs with offline network traffic analysis and threat intelligence capabilities. Built on Wireshark's tshark, it provides PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.

How to use NetForensicMCP?

Install Node.js (v16+), Wireshark (tshark in PATH), and clone the repository. Run npm install then node index.js. Configure an MCP client (e.g., Cursor IDE or Claude Desktop) with the path to index.js and the command node.

Key features of NetForensicMCP

Smart stream analysis with intelligent chunking for large PCAPs
Threat intelligence integration with URLhaus blacklist checking
Automated credential extraction across multiple protocols
High-frequency IP analysis for proactive threat hunting
Paginated stream content extraction and size estimation
Legacy live traffic capture for compatibility

Use cases of NetForensicMCP

Threat hunting: proactive identification of APT activities and C2 communications
Incident response: rapid forensic analysis of network evidence
Compliance auditing: credential leak detection and security gap identification
IOC extraction: automated indicator of compromise discovery
Attack reconstruction: timeline analysis and attack path visualization

常见问题

What are the runtime dependencies?

Requires Node.js v16+, Wireshark/tshark in PATH, and npm for dependency management. Works on Windows, macOS, and Linux.

How does NetForensicMCP handle large PCAP files?

It uses intelligent chunking with pagination support, content size estimation, and automated stream segmentation to prevent token overflow.

Where does threat intelligence data come from?

Built-in integration with URLhaus (abuse.ch) for comprehensive malware URL database checking.

Does NetForensicMCP support live traffic capture?

Legacy `capture_packets` tool is preserved for compatibility, but the focus is on offline forensic analysis.

How is the server configured for different MCP clients?

For Cursor IDE, edit `mcp.json` with the path to index.js. For Claude Desktop, edit the appropriate config file (macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`, Windows: `%APPDATA%\Claude\claude_desktop_config.json`).

其他分类下的更多 MCP 服务器

Activepieces

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

23.2K