Provides integration with pandas for parsing and analyzing Zeek log files, returning structured data from network traffic analysis as DataFrame objects.
Zeek-MCP
This repository provides a set of utilities to build an MCP server (Model Context Protocol) that you can integrate with your conversational AI client.
Table of Contents
Prerequisites
- Python 3.7+
- Zeek installed and available in your
PATH
(for theexeczeek
tool) - pip (for installing Python dependencies)
Installation
1. Clone the repository
2. Install dependencies
It's recommended to use a virtual environment:
Note: If you don’t have a
requirements.txt
, install directly:
Usage
The repository exposes two main MCP tools and a command-line entry point:
3. Run the MCP server
--mcp-host
: Host for the MCP server (default:127.0.0.1
).--mcp-port
: Port for the MCP server (default:8081
).--transport
: Transport protocol, eithersse
(Server-Sent Events) orstdio
.
4. Use the MCP tools
You need to use an LLM that can support the MCP tools usage by calling the following tools:
execzeek(pcap_path: str) -> str
- Description: Runs Zeek on the given PCAP file after deleting existing
.log
files in the working directory. - Returns: A string listing generated
.log
filenames or"1"
on error.
- Description: Runs Zeek on the given PCAP file after deleting existing
parselogs(logfile: str) -> DataFrame
- Description: Parses a single Zeek
.log
file and returns the parsed content.
- Description: Parses a single Zeek
You can interact with these endpoints via HTTP (if using SSE transport) or by embedding in LLM client (eg: Claude Desktop):
Claude Desktop integration:
To set up Claude Desktop as a Zeek MCP client, go to Claude
-> Settings
-> Developer
-> Edit Config
-> claude_desktop_config.json
and add the following:
Alternatively, edit this file directly:
5ire Integration:
Another MCP client that supports multiple models on the backend is 5ire. To set up Zeek-MCP, open 5ire and go to Tools
-> New
and set the following configurations:
- Tool Key: ZeekMCP
- Name: Zeek-MCP
- Command:
python /ABSOLUTE_PATH_TO/Bridge_Zeek_MCP.py
Alternatively you can use Chainlit framework and follow the documentation to integrate the MCP server.
Examples
An example of MCP tools usage from a chainlit chatbot client, it was used an example pcap file (you can find fews in pcaps folder)
License
See LICENSE
for more information.
This server cannot be installed
local-only server
The server can only run on the client's local machine because it depends on local resources.
A Model Context Protocol server that integrates Zeek network analysis capabilities with LLM chatbots, allowing them to analyze PCAP files and parse network logs through natural language interactions.
Related MCP Servers
- AsecurityAlicenseAqualityA Model Context Protocol server that provides LLM Agents with a comprehensive toolset for IP geolocation, network diagnostics, system monitoring, cryptographic operations, and QR code generation.Last updated -1656610TypeScriptApache 2.0
ZenML MCP Serverofficial
-securityAlicense-qualityA server implementing Model Context Protocol that enables LLMs to interact with the ZenML platform, providing access to pipeline data, stack information, and the ability to trigger new pipeline runs.Last updated -23PythonMIT License- AsecurityAlicenseAqualityA Model Context Protocol server that provides LLMs with real-time network traffic analysis capabilities, enabling tasks like threat hunting, network diagnostics, and anomaly detection through Wireshark's tshark.Last updated -7171JavaScriptMIT License
- AsecurityFlicenseAqualityA Model Context Protocol server that allows AI assistants to execute and manage JMeter performance tests through natural language commands.Last updated -236Python