Netforensicmcp

by kylecui

394 downloads

Not rated

GitHub

About

NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analys

Details

Author: kylecui
Downloads: 394
Categories: Other, Security

- Smart stream analysis with intelligent chunking for large PCAPs
- Threat intelligence integration with URLhaus blacklist checking
- Automated credential extraction across multiple protocols
- High-frequency IP analysis for proactive threat hunting
- Paginated stream content extraction and size estimation
- Legacy live traffic capture for compatibility

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Netforensicmcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

From the repository

Install Node.js (v16+), Wireshark (tshark in PATH), and clone the repository. Run npm install then node index.js. Configure an MCP client (e.g., Cursor IDE or Claude Desktop) with the path to index.js and the command node.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "netforensicmcp": {
            "NetForensicMCP": {
                "command": "node",
                "args": [
                    "index.js"
                ]
            }
        }
    }
}

McpServers

{
    "NetForensicMCP": {
        "command": "node",
        "args": [
            "index.js"
        ]
    }
}

NetForensicMCP v2.1

（Formerly WireMCP, Now Focused on Offline Forensic Analysis） > English | 中文 NetForensicMCP (formerly WireMCP) is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.

🚀 Key Features

Core Analysis Engine

- Smart Stream Analysis: Intelligent content chunking to handle large PCAP files without token overflow - Threat Intelligence Integration: Built-in URLhaus blacklist checking with stream correlation - Credential Extraction: Automated detection of plaintext credentials across multiple protocols - High-Frequency IP Analysis: Proactive threat hunting through top communicator identification

Advanced Tools

- get_summary_stats: Protocol hierarchy statistics for traffic composition overview - get_conversations: TCP/UDP conversation analysis with stream indexing - extract_stream_content: Precise payload extraction with pagination support - get_stream_info: Content size estimation to prevent token overflow - extract_stream_chunks: Automated large stream segmentation - get_top_ips: High-frequency communicator identification for proactive analysis - check_threats: Batch IP threat scanning with stream correlation - extract_credentials: Multi-protocol credential detection with context - capture_packets: Legacy live traffic capture (preserved for compatibility)

🔍 How It Empowers LLMs

NetForensicMCP transforms complex network forensics into LLM-accessible intelligence by: - 🎯 Threat-Driven Analysis: Prioritizes high-risk indicators over raw data processing - 📊 Structured Intelligence: Converts PCAP data into actionable threat intelligence - ⚡ Efficient Investigation: Optimized workflow prevents token exhaustion - 🔗 Correlation Engine: Links disparate network events into coherent attack narratives - 📝 Automated Reporting: Generates comprehensive security reports with IOCs and recommendations

🛡️ Cybersecurity Use Cases

- 🕵️ Threat Hunting: Proactive identification of APT activities and C2 communications - 🔍 Incident Response: Rapid forensic analysis of network evidence - 📋 Compliance Auditing: Credential leak detection and security gap identification - 🚨 IOC Extraction: Automated indicator of compromise discovery - 📖 Attack Reconstruction: Timeline analysis and attack path visualization

📋 Installation

Prerequisites

- Operating System: Windows, macOS, or Linux - Wireshark: Download here (tshark must be in PATH) - Node.js: v16+ recommended - npm: For dependency management

Setup

1. Clone the repository: ``

bash
   git clone https://github.com/kylecui/NetForensicMCP.git
   cd NetForensicMCP



2. Install dependencies:

bash
   npm install



3. Launch the MCP server:

bash
   node index.js



> Note: NetForensicMCP auto-detects tshark or falls back to common installation paths on all platforms.

⚙️ MCP Client Configuration


Cursor IDE

Edit

mcp.json

 in Cursor → Settings → MCP:

json
{
  "mcpServers": {
    "netforensicmcp": {
      "command": "node",
      "args": [
        "/ABSOLUTE_PATH_TO/NetForensicMCP/index.js"
      ]
    }
  }
}



Claude Desktop

macOS:

~/Library/Application Support/Claude/claude_desktop_config.json

  
Windows:

%APPDATA%\Claude\claude_desktop_config.json

json
{
  "mcpServers": {
    "wiremcp": {
      "command": "node",
      "args": ["C:\\path\\to\\NetForensicMCP\\index.js"]
    }
  }
}



🔬 Example Analysis Workflows


Threat Intelligence Analysis

``bash

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

NetForensicMCP v2.1

🚀 Key Features

Core Analysis Engine

Advanced Tools

🔍 How It Empowers LLMs

🛡️ Cybersecurity Use Cases

📋 Installation

Prerequisites

Setup

⚙️ MCP Client Configuration

Cursor IDE

Claude Desktop

🔬 Example Analysis Workflows

Threat Intelligence Analysis

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Reactive Resume

FastMCP v2 🚀