WireMCP Network Analyzer

Example Use Cases

• 1

  Inspect live network packets and extract structured JSON packet fields (IPs, ports, HTTP methods) for analysis or reasoning.

• 2

  Perform threat-hunting workflows by checking captured IPs against URLhaus and other threat feeds.

• 3

  Analyze PCAP files, extract potential credentials, summarize protocol usage, and generate human-readable reports from packet data.

Description

WireMCP is an MCP server that wraps Wireshark's tshark to provide LLMs with structured, JSON-formatted network context. It offers live packet capture, protocol summary statistics, conversation tracking, PCAP analysis, credential extraction, and basic IOC checks (URLhaus). This enables agents to perform real-time traffic analysis, post-capture forensic work, and integrate simple threat intelligence into reasoning. The project is open-source and intended to run locally where tshark is available.