Sharkmcp

Name: Sharkmcp
Author: kriztalz

@kriztalz

代码仓库

关于 Sharkmcp

A tshark MCP server for packet capture and analysis

#wireshark #shark #tshark #pcap #pcapng #packet #monitoring

基本信息

分类

其他

传输方式

stdio

发布者

kriztalz

提交者

配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "sharkmcp": {
      "command": "node",
      "args": [
        "/path/to/SharkMCP/dist/index.js"
      ]
    }
  }
}

工具

未检测到工具

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is SharkMCP?

SharkMCP is a Model Context Protocol (MCP) server that provides network packet capture and analysis capabilities through Wireshark/tshark integration. It is designed for AI assistants to perform network security analysis, troubleshooting, and packet inspection, particularly for debugging applications by recording traffic during test runs.

How to use SharkMCP?

Install by cloning the repository, then run pnpm install and pnpm run build. Start the server with pnpm start and configure your MCP client with the server command pointing to the built index.js. Use the tools start_capture_session, stop_capture_session, analyze_pcap_file, and manage_config to capture, analyze, and manage packet traffic.

Key features of SharkMCP

Async background packet capture with filters and timeouts
Analyze existing PCAP files
Flexible output: JSON, custom fields, or text
SSL/TLS decryption via SSL keylog files
Reusable capture and analysis configurations

Use cases of SharkMCP

Debugging a program by recording and inspecting its network traffic
Network security analysis and intrusion detection
Troubleshooting connectivity and protocol issues
Monitoring HTTPS traffic with SSL keylog decryption

FAQ from SharkMCP

What are the system prerequisites?

Node.js version 18+, pnpm, and a working installation of Wireshark/tshark that is accessible from the command line.

How do I fix "tshark not found"?

Ensure Wireshark is installed and that tshark is in your system PATH; verify with tshark -v.

What should I do if I get "permission denied" for packet capture?

On Linux, add your user to the wireshark group or run with sudo. On macOS, grant Terminal network access in System Preferences. On Windows, run the application as Administrator.

How can I decrypt HTTPS traffic?

Set the environment variable SSLKEYLOGFILE to a file path, configure your applications to log SSL keys there, then pass that file path to the stop_capture_session tool.