Sharkmcp
About
A tshark MCP server for packet capture and analysis
Explore
- Async Packet Capture: Start background capture sessions with configurable filters and timeouts.
- PCAP File Analysis: Analyze existing packet capture files
- Flexible Output Formats: JSON, custom fields, or traditional text output
- SSL/TLS Decryption: Support for SSL keylog files to decrypt HTTPS traffic
- Reusable Configurations: Save and reuse capture/analysis configurations
/!\ Packet information can be very extensive. Make sure to use a scoped display filter not to overload the context of your conversation.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
SharkmcpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
1. Clone the repository:
git clone https://github.com/kriztalz/SharkMCP.git
cd SharkMCP
2. Install dependencies:
pnpm install
3. Build the project:
pnpm run build
4. Run the server:
pnpm start
macOS (using Homebrew):
brew install wireshark
Ubuntu/Debian:
sudo apt update
sudo apt install tshark wireshark-common
Windows:
Download from wireshark.org
1. start_capture_session: Start background packet capture
2. stop_capture_session: Stop capture and analyze results
3. analyze_pcap_file: Analyze existing PCAP files
4. manage_config: Save/load reusable configurations
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"sharkmcp": {
"sharkmcp": {
"command": "node",
"args": [
"/path/to/SharkMCP/dist/index.js"
]
}
}
}
}McpServers
{
"sharkmcp": {
"command": "node",
"args": [
"/path/to/SharkMCP/dist/index.js"
]
}
}A Model Context Protocol (MCP) server that provides network packet capture and analysis capabilities through Wireshark/tshark integration. Designed for AI assistants to perform network security analysis, troubleshooting, and packet inspection.
This server was thought for situations where you want your agent to debug a program that sends requests and verify the packet traffic, allowing the following workflow:
- Start recording packets
- Run tool or perform request
- Stop recording and analyze results
Architecture
SharkMCP provides a simple, local development-focused architecture:
┌─────────────────────────────────────────────────────────┐
│ SharkMCP Server │
├─────────────────────────────────────────────────────────┤
│ MCP Protocol Layer │
│ ├─ start_capture_session │
│ ├─ stop_capture_session │
│ ├─ analyze_pcap_file │
│ └─ manage_config │
├─────────────────────────────────────────────────────────┤
│ tshark Integration Layer │
│ ├─ Cross-platform executable detection │
│ ├─ Process management │
│ └─ Output parsing (JSON/fields/text) │
├─────────────────────────────────────────────────────────┤
│ Host System Integration │
│ ├─ Local tshark installation │
│ ├─ Direct network interface access │
│ └─ Native file system operations │
└─────────────────────────────────────────────────────────┘
Features
- Async Packet Capture: Start background capture sessions with configurable filters and timeouts.
- PCAP File Analysis: Analyze existing packet capture files
- Flexible Output Formats: JSON, custom fields, or traditional text output
- SSL/TLS Decryption: Support for SSL keylog files to decrypt HTTPS traffic
- Reusable Configurations: Save and reuse capture/analysis configurations
/!\ Packet information can be very extensive. Make sure to use a scoped display filter not to overload the context of your conversation.
Prerequisites
System Requirements
- Wireshark/tshark: Must be installed and accessible - Node.js: Version 18+ - pnpm: Package manager (recommended)Installing Wireshark/tshark
macOS (using Homebrew):
brew install wireshark
Ubuntu/Debian:
sudo apt update
sudo apt install tshark wireshark-common
Windows:
Download from wireshark.org
Installation
1. Clone the repository:
git clone https://github.com/kriztalz/SharkMCP.git
cd SharkMCP
2. Install dependencies:
pnpm install
3. Build the project:
pnpm run build
4. Run the server:
pnpm start
Testing
SharkMCP includes comprehensive integration tests that verify packet capture functionality.
Running Tests
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
