WireMCP MCP Server

WireMCP becomes available to MCP clients through the wiremcp mcp server. An MCP for network sleuthing.

What WireMCP does

WireMCP works with any MCP-compliant client. Below are examples for popular clients:

Key capabilities

• capture_packets — Captures live traffic and returns raw packet data as JSON, enabling LLMs to analyze packet-level details (e.g., IP addresses, ports, HTTP methods)
• get_summary_stats — Provides protocol hierarchy statistics, giving LLMs an overview of traffic composition (e.g., TCP vs. UDP usage)
• get_conversations — Delivers TCP/UDP conversation statistics, allowing LLMs to track communication flows between endpoints
• check_threats — Captures IPs and checks them against the URLhaus blacklist, equipping LLMs with threat intelligence context for identifying malicious activity
• check_ip_threats — Performs targeted threat intelligence lookups for specific IP addresses against multiple threat feeds, providing detailed reputation and threat data
• analyze_pcap — Analyzes PCAP files to provide comprehensive packet data in JSON format, enabling detailed post-capture analysis of network traffic
• extract_credentials — Scans PCAP files for potential credentials from various protocols (HTTP Basic Auth, FTP, Telnet), aiding in security audits and forensic analysis

Requirements

• Mac / Windows / Linux - Wireshark (with tshark installed and accessible in PATH) - Node.js (v16+ recommended) - npm (for dependency installation)

Practical notes

• Maintained by 0xKoda.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.