mcp-wireshark

Community-maintained MCP server for Wireshark / tshark. Not affiliated with Wireshark or Anthropic. Give your AI assistant direct access to packet captures. Ask Claude to summarize a .pcap, follow a TCP stream, filter for a specific protocol, or capture live traffic — all without leaving the chat.

---

Quick start with Claude Code

pip install mcp-wireshark
claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

That's it. Open Claude Code and try:

"Summarize ./capture.pcap and tell me which IPs talked the most."

--scope user makes the server available across every Claude Code project. Drop the flag to install it for the current project only. See claude mcp docs for more.

Verify the install

claude mcp list

You should see mcp-wireshark listed. Inside Claude Code, ask:

"Run check_installation."

If tshark is on your PATH, it returns the version. If not, see troubleshooting.

---

Tools

The server exposes 14 tools, split cleanly between read tools (safe, no side effects) and write tools (capture traffic or write files). Both groups are annotated with the standard MCP readOnlyHint so any compliant client can surface the distinction.

Read tools

Safe to call freely — they only inspect state.

Tool	What it does
check_installation	Verify tshark is installed and show version
list_interfaces	List network interfaces available to capture from
read_pcap	Read packets from a .pcap / .pcapng file (preview + total count)
display_filter	Apply a Wireshark display filter to a pcap
summarize_pcap	High-level summary: I/O stats, protocol hierarchy, top talkers
stats_by_proto	Protocol hierarchy statistics
follow_tcp	Reassemble a TCP stream and return its payload
follow_udp	Reassemble a UDP stream and return its payload
expert_info	tshark expert analysis: warnings, errors, and notes grouped by severity
decode_protocol	Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol
protocol_stats	Aggregate -z reports (protocol hierarchy, conversations, endpoints, HTTP/DNS/SMB stats)
analyze_iec61850	Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors

Write tools

These create files or capture live traffic. Compliant clients may prompt before invoking.