Community-maintained MCP server for Wireshark / tshark. Not affiliated with Wireshark or Anthropic. Give your AI assistant direct access to packet captures. Ask Claude to summarize a .pcap, follow a…
MCP Wireshark is an MCP project maintained in the khuynh22/mcp-wireshark repository. The maintainer describes its purpose as “Community-maintained MCP server for Wireshark / tshark. Not affiliated with Wireshark or Anthropic. Give your AI assistant direct access to packet captures. Ask Claude to…”. Read the project documentation for the complete scope.
The project provides a local client configuration using mcp-wireshark. Follow the repository’s build and installation steps before copying it, and replace example paths with the paths on your own computer.
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| check_installation | Verify tshark is installed and show version |
| list_interfaces | List network interfaces available to capture from |
| read_pcap | Read packets from a .pcap / .pcapng file (preview + total count) |
| display_filter | Apply a Wireshark display filter to a pcap |
| summarize_pcap | High-level summary: I/O stats, protocol hierarchy, top talkers |
| stats_by_proto | Protocol hierarchy statistics |
| follow_tcp | Reassemble a TCP stream and return its payload |
| follow_udp | Reassemble a UDP stream and return its payload |
| expert_info | tshark expert analysis: warnings, errors, and notes grouped by severity |
| decode_protocol | Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol |
| protocol_stats | Aggregate -z reports (protocol hierarchy, conversations, endpoints, HTTP/DNS/SMB stats) |
| analyze_iec61850 | Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors |
| live_capture | Capture live traffic from an interface (capped at 5 minutes / 10k packets) |
| export_json | Export packets from a pcap to a JSON file at a path you choose |
{
"mcpServers": {
"wireshark": {
"command": "mcp-wireshark"
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
The original Chromium automation reference server — simple, screenshot-driven browser control.
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Automates browsers and APIs, enabling Large Language Models (LLMs) to interact with web pages for tasks like screenshot capture and JavaScript
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Search built for AI, not humans — semantic web search that returns model-ready content, plus code context.
Answers, not links — delegate questions to Perplexity's search-grounded models and get cited responses back.