Zeek-MCP
About
Integrates Zeek network analysis with conversational AI clients. Requires an external Zeek installation.
Details
- Author
- gabbo01
- Categories
- Developer Tools
Jump to
Setup
Install Zeek-MCP in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/gabbo01/Zeek-MCP
Follow the installation instructions in the repository README, then restart your MCP client.
This repository provides a set of utilities to build an MCP server (Model Context Protocol) that you can integrate with your conversational AI client.
- 1. Clone the repository
- 2. Install dependencies
- 3. Run the MCP server
- 4. Use the MCP tools
- Python 3.7+
- Zeekinstalled and available in yourPATH(for theexeczeektool)
- pip(for installing Python dependencies)
git clone https://github.com/Gabbo01/Zeek-MCP cd Zeek-MCP
It's recommended to use a virtual environment:
python -m venv venv source venv/bin/activate # Linux/macOS venv\Scripts\activate # Windows pip install -r requirements.txt
Note:If you don’t have arequirements.txt, install directly:
The repository exposes two main MCP tools and a command-line entry point:
python Bridge_Zeek_MCP.py --mcp-host 127.0.0.1 --mcp-port 8081 --transport sse
- --mcp-host: Host for the MCP server (default:127.0.0.1).
- --mcp-port: Port for the MCP server (default:8081).
- --transport: Transport protocol, eithersse(Server-Sent Events) orstdio.
You need to use an LLM that can support the MCP tools usage by calling the following tools:
- Description:Runs Zeek on the given PCAP file after deleting existing.logfiles in the working directory.
- Returns:A string listing generated.logfilenames or"1"on error.
- Description:Parses a single Zeek.logfile and returns the parsed content.
You can interact with these endpoints via HTTP (if using SSE transport) or by embedding in LLM client (eg: Claude Desktop):
To set up Claude Desktop as a Zeek MCP client, go toClaude->Settings->Developer->Edit Config->claude_desktop_config.jsonand add the following:
{ "mcpServers": { "Zeek-mcp": { "command": "python", "args": [ "/ABSOLUTE_PATH_TO/Bridge_Zeek_MCP.py", ] } } }
/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json
Another MCP client that supports multiple models on the backend is5ire. To set up Zeek-MCP, open 5ire and go toTools->Newand set the following configurations:
- Tool Key: ZeekMCP
- Name: Zeek-MCP
- Command:python /ABSOLUTE_PATH_TO/Bridge_Zeek_MCP.py
An example of MCP tools usage from a chainlit chatbot client, it was used an example pcap file (you can find fews in pcaps folder)
In that case the used model was claude-3.7-sonnet-reasoning-gemma3-12b
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Create crafted UI components inspired by the best 21st.dev design engineers.
Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server
An MCP server to help AI assistants to answer questions and generate AccelByte Extend SDK code more effectively .
MCP server for AI Diagram Maker — generate beautiful software engineering diagrams directly inside Cursor, Claude Desktop, Claude Code, or any MCP-compatible AI agent
ALAPI MCP Tools,Call hundreds of API interfaces via MCP
AI-powered SVG animation generator that transforms static files into animated SVG components using the Allyson platform
MCP server that gives AI assistants on-demand access to 1,500+ amCharts docs, ~300 code examples, and 1000+ class API references.
APIMatic MCP Server is used to validate OpenAPI specifications using APIMatic. The server processes OpenAPI files and returns validation summaries by leveraging APIMatic’s API.
One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.
Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.





