WireMCP MCP Server

WireMCP becomes available to MCP clients through the wiremcp mcp server. An MCP for network sleuthing.

What WireMCP does

WireMCP works with any MCP-compliant client. Below are examples for popular clients:

Key capabilities

• capture_packets — Captures live traffic and returns raw packet data as JSON, enabling LLMs to analyze packet-level details (e.g., IP addresses, ports, HTTP methods)
• get_summary_stats — Provides protocol hierarchy statistics, giving LLMs an overview of traffic composition (e.g., TCP vs. UDP usage)
• get_conversations — Delivers TCP/UDP conversation statistics, allowing LLMs to track communication flows between endpoints
• check_threats — Captures IPs and checks them against the URLhaus blacklist, equipping LLMs with threat intelligence context for identifying malicious activity
• check_ip_threats — Performs targeted threat intelligence lookups for specific IP addresses against multiple threat feeds, providing detailed reputation and threat data
• analyze_pcap — Analyzes PCAP files to provide comprehensive packet data in JSON format, enabling detailed post-capture analysis of network traffic
• extract_credentials — Scans PCAP files for potential credentials from various protocols (HTTP Basic Auth, FTP, Telnet), aiding in security audits and forensic analysis

Installing the wiremcp mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Requirements

• Mac / Windows / Linux - Wireshark (with tshark installed and accessible in PATH) - Node.js (v16+ recommended) - npm (for dependency installation)

Where it fits

Developer-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. WireMCP sits in that group. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• Maintained by 0xKoda.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the wiremcp mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.