Wireshark MCP
Give your AI assistant a packet analyzer.
Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
English • 中文 • Docs • Changelog • Roadmap • Contributing
What is this?
An MCP server that wraps tshark (and optional Wireshark suite tools) into a structured analysis interface. Works with Claude Desktop, Claude Code, Cursor, VS Code, and 18+ other MCP clients.
You: "Find all DNS queries going to suspicious domains in this capture."
Claude: [calls wireshark_extract_dns_queries → wireshark_detect_dns_tunnel]
"Found repeated high-entropy DNS queries consistent with tunneling: ..."Install
Claude Code / Codex plugin route
Prerequisites: uv and Wireshark CLI (tshark). The plugin includes this project and both skills; the client runs the locked Python project through uv over stdio. It does not install Wireshark or capture drivers.
From a checkout containing these plugin manifests, choose your client:
# Codex
codex plugin marketplace add .
codex plugin add wireshark-mcp@wireshark-mcp
# Claude Code
claude plugin marketplace add .
claude plugin install wireshark-mcp@wireshark-mcp
