Skip to main content
Glama

wireshark-mcp

An MCP server that exposes Wireshark's CLI tools (tshark, dumpcap, capinfos) to a local LLM client. It lets a model start bounded live captures and analyze existing capture files — packet summaries, protocol hierarchies, conversations, endpoints, expert info, stream reassembly — without ever handing it a shell.

Security

This server lets a local language model capture and read your network traffic. That is its purpose, and you should install it only if you want that.

What it does to stay bounded:

  • No shell. Every subprocess runs with shell=False and an argument list built in code. The model supplies typed values, never flags.

  • No arbitrary-command tool. There is no run_tshark. The tool surface is fixed.

  • Path sandbox. Capture files are read only from the server's own workdir and from directories you list in read_only_dirs. Traversal, symlink escapes, UNC paths, and drive-relative paths are rejected.

  • Bounded captures. Every capture requires both a duration and a packet cap, ceilings 300 seconds and 100,000 packets. An unbounded capture cannot be requested.

  • Interface allowlist. Set interface_allowlist to limit which interfaces can be captured on.

  • Audit log. Every capture and every read is appended to audit.log in the workdir.

What it does not protect you from: captured packets contain whatever crossed the wire, including credentials sent over cleartext protocols. Anything the model reads from a capture is in the model's context.

Related MCP server: Wireshark MCP

Prerequisites

Wireshark (which bundles tshark, dumpcap, and capinfos) must be installed and on PATH, or pointed to explicitly in config.toml.

Supported platforms: macOS and Windows. Linux is expected to work but is untested and is not a release target.

macOS

  • Install Wireshark (e.g. brew install --cask wireshark).

  • For non-root live capture, install ChmodBPF (bundled with the Wireshark installer/cask) so your user can open /dev/bpf*. Without it, live capture requires running as root; file analysis works regardless.

Windows

  • Install Wireshark, which offers to install Npcap — required for live capture.

  • If Npcap was installed with "Restrict Npcap driver's access to Administrators only", the MCP client (e.g. LM Studio) must run elevated for live capture to work. File analysis works either way.

Install and run

uvx --from git+https://github.com/MrDadpool/wireshark-mcp wireshark-mcp

This runs the wireshark-mcp console script (wireshark_mcp.server:main) over stdio, for use by any MCP-speaking client.

Use with LM Studio

Add to LM Studio's mcp.json (Program → Install → Edit mcp.json):

{
  "mcpServers": {
    "wireshark": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/MrDadpool/wireshark-mcp", "wireshark-mcp"]
    }
  }
}

On Windows, if Npcap was installed with "Restrict Npcap driver's access to Administrators only", LM Studio must run elevated for live capture to work. File analysis works either way.

Tools

There are 12 tools. Ceilings: duration_s <= 300, max_packets <= 100,000, limit <= 500.

Tool

Parameters

Description

list_interfaces

List capture interfaces, with whether live capture is currently permitted.

start_capture

interface, duration_s=10, max_packets=1000, bpf_filter=""

Capture live packets on an interface. Always bounded by both duration and packet count.

list_captures

List capture files this server has stored.

packet_summary

capture, display_filter="", limit=100

One line per packet, optionally narrowed by a Wireshark display filter.

packet_detail

capture, frame_no

Full decoded protocol tree for a single frame.

capture_info

capture

capinfos summary: packet count, duration, byte totals, encapsulation.

protocol_hierarchy

capture

Protocol hierarchy statistics for the whole capture.

conversations

capture, type="tcp"

Conversation statistics. type is one of tcp, udp, ip, eth.

endpoints

capture, type="ip"

Endpoint statistics. type is one of tcp, udp, ip, eth.

io_stats

capture, interval_s=1

Traffic volume over time, bucketed by interval_s seconds.

expert_info

capture

Wireshark expert info: retransmissions, resets, malformed packets, warnings.

follow_stream

capture, protocol="tcp", index=0

Reassemble one stream as ASCII. protocol is one of tcp, udp, http.

There is deliberately no run_tshark or other arbitrary-command tool.

Configuration

The server reads an optional TOML file from its workdir:

  • macOS: ~/.wireshark-mcp/config.toml

  • Windows: %LOCALAPPDATA%\wireshark-mcp\config.toml

See examples/config.toml for every available setting (workdir, read_only_dirs, interface_allowlist, and [binaries] overrides for tshark/dumpcap/capinfos). Every setting is optional; a missing file is not an error.

Development

uv sync --extra dev
uv run ruff check .
uv run pytest -v

Tests are split into unit tests (always run) and two markers that require local capabilities not present on CI runners:

  • requires_tshark — needs a resolvable tshark binary.

  • requires_capture — needs live capture permission on the host.

CI (.github/workflows/ci.yml) runs on macos-latest and windows-latest, where Wireshark is not installed, so those two tiers skip there; that is expected. The platform, sandbox, argv, and error tests are what CI actually guards, and they are the tests that catch cross-platform regressions.

Available Tools

12 tools
capture_infoC

capinfos summary: packet count, duration, byte totals, encapsulation.

ParametersJSON Schema
NameRequiredDescriptionDefault
captureYes

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only lists output fields and does not mention whether the tool mutates anything, requires special permissions, has side effects, or returns results in a specific format. It implies a read-only analysis but never states it, leaving significant behavioral uncertainty for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, essentially a single fragment. While this avoids verbosity, it sacrifices necessary detail. It front-loads the core output fields, but leaves out usage context and parameter clarification. Conciseness is achieved at the expense of completeness, so it earns only a middling score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's apparent complexity (analyzing a capture) and the absence of an output schema, annotations, and parameter descriptions, the description is drastically incomplete. An agent cannot safely determine how to call the tool (what to pass for 'capture') or interpret the result beyond the listed fields. It falls far short of what is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'capture' has no schema description (coverage 0%). The tool description does not explain what 'capture' refers to—a file path, a capture ID, or an interface name—nor does it specify expected format or constraints. Since the description is the only source of parameter meaning and it provides none, this is a critical gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear purpose: it provides a summary (packet count, duration, byte totals, encapsulation) for a capture. This is specific enough to distinguish it from packet_detail or packet_summary, which likely offer different granularity. However, it does not explicitly mention that it operates on a captured file versus a live capture, leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no guidance on when to use this tool versus siblings like packet_summary, protocol_hierarchy, or io_stats. It does not state whether this is a read-only analysis, what prerequisites exist (e.g., a valid capture ID), or when another tool would be more appropriate. The user is left to infer usage entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

conversationsC

Conversation statistics. type is one of tcp, udp, ip, eth.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNotcp
captureYes

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavior, but it only says "statistics" and lists type options. It does not state whether the operation is read-only, what capture must refer to, how the results are shaped, or what constraints apply to the capture parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and contains no filler, and the type constraint is immediately useful. However, it is telegraphic and lacks a clear verb or structured explanation of the tool's behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, yet the description leaves out core details such as what capture identifies, what the result contains, and how type changes the result. An agent would struggle to call this tool correctly beyond knowing capture is required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only documents the allowed values for type. The required capture parameter is completely unexplained, and the description does not clarify how type affects the returned conversation statistics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Conversation statistics" names a resource and the type field gives some specificity, but there is no verb explaining what the tool does with conversations. It also does not distinguish itself from sibling tools like endpoints, protocol_hierarchy, or io_stats, which could plausibly return similar or overlapping statistics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as endpoints, protocol_hierarchy, or io_stats. It only states that type is one of tcp, udp, ip, eth, which is not enough for an agent to choose this tool confidently.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

endpointsC

Endpoint statistics. type is one of tcp, udp, ip, eth.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoip
captureYes

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure, but it only says 'Endpoint statistics' and lists type values. It implies a read-only statistics lookup but does not describe output shape, aggregation behavior, or the relationship to an existing capture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no filler, and the type constraint is front-loaded. Its weakness is under-specification rather than verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and a required capture parameter, this description omits essential context: what capture refers to, what statistics are included, and what the result looks like. It provides only a partial type enum, which is not enough for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds allowed values for type, which the schema does not provide, but it leaves the required capture parameter completely unexplained. With 0% schema coverage, an agent still cannot confidently populate the required parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase 'Endpoint statistics' identifies the resource and the type list adds some specificity, but there is no verb and no differentiation from sibling tools like conversations, protocol_hierarchy, or io_stats. Reasonably clear subject matter, but not a precise, self-contained purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus the other statistics and capture-analysis siblings. The only usage-like content is the type constraint, which is really a parameter note rather than a selection rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

expert_infoC

Wireshark expert info: retransmissions, resets, malformed packets, warnings.

ParametersJSON Schema
NameRequiredDescriptionDefault
captureYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry behavioral disclosure. It lists content categories but does not state whether this is a read-only query, whether a live capture is required, or how results are returned. It does not contradict annotations, but the operational behavior remains mostly implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Nine words with no filler; the core concept and contents are front-loaded. It is efficient, though the efficiency comes at the cost of elaboration handled in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and an unexplained required parameter, an agent cannot confidently determine what to pass or what shape the result will take. The tool is structurally simple, but the description leaves the input contract and result format unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter 'capture' is only defined by its schema type (string), with 0% schema description coverage, and the description never explains what a capture is or how to specify it (ID, filename, etc.). The description adds no parameter-level guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific Wireshark feature ('expert info') and enumerates the categories it exposes (retransmissions, resets, malformed packets, warnings). It lacks an explicit verb like 'retrieve', but the resource and scope are clear enough to distinguish it from generic siblings like capture_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use expert_info over capture_info, packet_summary, or other siblings, and no exclusions or prerequisites are stated. The description only implies a tool for expert-level diagnostics.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

follow_streamC

Reassemble one stream as ASCII. protocol is one of tcp, udp, http.

ParametersJSON Schema
NameRequiredDescriptionDefault
indexNo
captureYes
protocolNotcp

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full burden of behavioral disclosure. It mentions that it reassembles a stream as ASCII, implying a read operation, but does not describe output format, side effects, limitations (e.g., binary data conversion), or prerequisites like needing a capture first. This leaves significant behavior unspecified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler. It leads with the main action and resource, which is good. It is concise and easy to parse, though it could have included more detail without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, no annotations, and no output schema, the description is notably incomplete. It does not explain the nature of the output (e.g., text body), the meaning of 'capture' and 'index', or when to use this tool. This is insufficient for an agent to correctly invoke it in a real workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for explaining parameters. It clarifies that 'protocol' is limited to tcp, udp, or http, but does not explain what 'capture' refers to or what 'index' means (likely a stream index). This leaves key parameters under-explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Reassemble one stream as ASCII,' which is a specific verb and resource. It also specifies the protocol options. It is distinct from siblings like packet_summary and packet_detail, though it doesn't explicitly name them. The purpose is unambiguous enough for an agent to know what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no guidance on when to use this tool versus alternatives. It does not mention conditions, prerequisites, or typical use cases. The only extra instruction is the protocol list, which is parameter-specific, not usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

io_statsC

Traffic volume over time, bucketed by interval_s seconds.

ParametersJSON Schema
NameRequiredDescriptionDefault
captureYes
interval_sNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, but it only says what data is shown, not how the tool behaves. It does not mention whether the operation is read-only, what unit the traffic volume uses, how interval_s affects bucket boundaries, or what happens for an invalid capture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short sentence with no wasted words, and the core concept is front-loaded. It sacrifices behavioral detail for brevity, but as far as conciseness goes it is well-structured and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description is too thin to be fully actionable. An agent still needs to infer what 'capture' refers to, what the returned time series looks like, and how to interpret 'traffic volume'. The description covers the basic idea but not enough of the operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning for interval_s by clarifying it is the time interval in seconds, which is not in the schema beyond its integer type and default. However, the required capture parameter is not explained at all, and schema description coverage is 0%, so the description only partially compensates for the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear resource: traffic volume over time, bucketed by interval_s seconds. It effectively distinguishes the tool from siblings like packet_summary, conversations, and protocol_hierarchy, which address different analytical views. However, it lacks an explicit verb such as 'returns' or 'displays', so it stops short of a fully specific statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the tool to use when traffic volume over time is needed, especially since interval_s controls the bucket width. It does not explicitly mention when not to use it or name alternatives such as packet_summary or conversations, leaving usage conditions to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_capturesA

List capture files this server has stored.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the behavioral disclosure burden. The verb 'List' implies a read-only, non-destructive operation, and 'stored' indicates local retrieval, but it does not disclose output format, permissions, pagination, or any side-effect-free guarantee beyond what the verb implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every word contributes meaning, stating the action, the object, and the scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool with no output schema, the description covers the essential context: what is listed and from where. It is nearly complete, though it could briefly mention what the returned list contains, but the description name and siblings make that largely unnecessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the description has no parameter semantics to explain. The baseline for a zero-parameter tool is 4, and the description does not need to compensate for any missing parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List'), a clear resource ('capture files'), and scopes it to 'this server has stored,' which distinguishes it from sibling tools like list_interfaces. An agent can tell exactly what this tool does without inspecting schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: use this when you need to see capture files stored on the server. However, it does not explicitly mention when not to use it or name an alternative such as list_interfaces, so the guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_interfacesA

List capture interfaces, with whether live capture is currently permitted.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It communicates a read-only listing action and the permission-state information it returns. It does not overstate side effects or contradict anything in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence says exactly what the tool does and what extra information it provides. There is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless listing tool with no annotations and no output schema, this description is largely sufficient. It could be slightly more complete by hinting at return structure or naming related capture tools, but the current level of detail is adequate for safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description does not need to compensate for schema gaps, and it appropriately focuses on the behavior and output rather than parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource pairing ('List capture interfaces') and adds a distinctive output detail ('with whether live capture is currently permitted'). This clearly differentiates it from sibling tools like list_captures or start_capture.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context of listing capture interfaces is clear, and an agent can infer this is a preliminary step before starting a capture. However, the description does not explicitly state when to use this tool versus alternatives or mention any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

packet_detailB

Full decoded protocol tree for a single frame.

ParametersJSON Schema
NameRequiredDescriptionDefault
captureYes
frame_noYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full behavioral disclosure burden. It only states the output type and does not mention whether the operation is read-only, how missing or invalid frames are handled, or any other side effects. This is a significant gap for a tool with zero annotation context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no filler. It front-loads the key concept of a full decoded protocol tree and adds the scoping detail 'for a single frame'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter query tool, the description captures the essence of the tool's purpose and output. However, it lacks usage guidance, parameter clarity, and behavioral details like error handling, making it only minimally viable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explain the meaning or expected format of 'capture' or 'frame_no'. The parameter names are suggestive but the description must compensate for the missing schema descriptions, and it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool provides a full decoded protocol tree for a single frame, which distinguishes it from packet_summary and protocol_hierarchy. However, it lacks an explicit verb like 'returns' or 'shows', relying on an implied action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for a single frame' implies when to use this tool: when detailed per-frame protocol decoding is needed. It does not explicitly mention when not to use it or name alternative tools such as packet_summary or protocol_hierarchy.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

packet_summaryB

One line per packet, optionally narrowed by a Wireshark display filter.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
captureYes
display_filterNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does state the output granularity and the display filter behavior, but it does not explicitly say the operation is read-only, describe truncation or limit effects, or mention any prerequisites for the capture parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every word contributes to the tool's meaning, and it avoids repeating parameter names or schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is too thin. It does not clarify what a one-line-per-packet output looks like, how limit interacts with the result, or how this relates to the many sibling analysis tools, leaving an agent to rely on the parameter schema alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate for all three parameters. It adds meaning to display_filter by specifying it as a Wireshark display filter, but it does not explain the required capture parameter or the semantics of limit beyond the schema's default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly conveys the core output ('one line per packet') and the optional filtering behavior, which is a distinct resource from siblings like packet_detail or capture_info. It does not over-explain, but it is specific enough to understand what packet_summary produces.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as packet_detail, capture_info, or follow_stream. The only implied usage is when a concise packet list is desired, but there is no explicit when-to-use or when-not-to-use instruction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

protocol_hierarchyC

Protocol hierarchy statistics for the whole capture.

ParametersJSON Schema
NameRequiredDescriptionDefault
captureYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The word 'statistics' implies a read-only operation, but it never explicitly states that it is non-destructive, what the output format is, or whether it has performance implications (e.g., large captures). The description adds little beyond the basic purpose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using a single straightforward sentence. It is front-loaded with the main purpose. However, it is also so terse that it omits potentially useful context; the structure is good but the content is minimal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, no annotations, and only one parameter with zero schema description, the description is severely incomplete. It does not explain what 'protocol hierarchy statistics' actually include, how the output is structured, or any usage constraints. An agent would have to make many assumptions to invoke this tool correctly, making it inadequate for autonomous use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the 'capture' parameter. It says 'whole capture' which hints that the capture is a capture identifier, but it does not specify the expected format (e.g., ID, name, or path), whether it is required, or how it relates to other tools' capture parameters. The agent is left guessing about how to supply this value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair: it provides protocol hierarchy statistics for the whole capture. It clearly identifies the resource (the capture) and the nature of the tool (statistics). However, it does not explicitly differentiate itself from siblings like io_stats or conversations, though the term 'protocol hierarchy' is distinctive enough that a well-equipped agent could infer separation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. It does not mention prerequisites, suitable contexts, or exclusions. An agent receives no hint about whether to prefer this over packet_summary or conversations for a given analysis task.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_captureB

Capture live packets on an interface. Always bounded by BOTH duration_s and max_packets.

ParametersJSON Schema
NameRequiredDescriptionDefault
interfaceYes
bpf_filterNo
duration_sNo
max_packetsNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses a critical behavioral guarantee: the capture is always bounded by both duration_s and max_packets, which implies the capture will terminate under those conditions. However, it does not describe whether the call blocks, returns immediately, or yields a capture handle, nor does it mention permissions or side effects beyond starting a capture. The single disclosed trait is useful but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two short sentences—and front-loaded with the action verb. There is zero fluff or redundancy. While it may be too terse for the tool's complexity, the conciseness itself is commendable; every word earns its place. It loses a point because it omits necessary detail rather than achieving brevity through efficient wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with four parameters, no schema descriptions, no annotations, and no output schema, the description is far too thin. It lacks essential context: what the interface parameter expects, how to specify a BPF filter, what happens after capture starts (e.g., how to reference it with sibling tools like capture_info or follow_stream), and whether a capture ID is returned. The 'bounded' clause is helpful but does not cover the operational workflow. An agent cannot confidently use this tool without external knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It mentions only duration_s and max_packets (as bounding constraints) but provides no meaning for the required parameter 'interface' or optional 'bpf_filter'. It does not clarify units, limits, or how max_packets interacts with duration_s beyond the 'both' clause. This is insufficient for an agent to correctly set parameters without additional inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Capture') and resource ('live packets on an interface'), making the tool's function unambiguous. It also adds a distinctive scope constraint ('Always bounded by BOTH duration_s and max_packets') that differentiates it from sibling tools like list_captures or packet_summary, which are not about starting a capture.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool vs. siblings. It does not mention prerequisites (e.g., selecting a valid interface via list_interfaces), when not to use it, or how the capture results are retrieved (e.g., via list_captures). The 'Always bounded' clause offers a runtime constraint but not usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

B3.3/5.0
Disambiguation5/5

Each tool targets a distinct task: capture management, packet inspection, and separate statistical views. packet_summary and packet_detail are clearly differentiated by granularity, and capture_info, protocol_hierarchy, conversations, endpoints, io_stats, and expert_info all answer different questions.

Naming Consistency3/5

Names are readable lower_snake, but the pattern is mixed: list_captures, list_interfaces, start_capture, and follow_stream are verb_noun while packet_summary, packet_detail, capture_info, protocol_hierarchy, conversations, endpoints, io_stats, and expert_info are noun-style result names. The split between command-style and result-style names is noticeable but not chaotic.

Tool Count5/5

Twelve tools is a well-scoped set for a Wireshark-oriented server: capture control, packet inspection, and a range of statistical analyses each earn their place. It stays within the ideal range and avoids unnecessary overlap.

Completeness5/5

The surface covers the core workflow: discover interfaces, start bounded captures, list stored captures, inspect frames, and compute standard Wireshark statistics. It includes both packet-level detail and protocol/expert diagnostics, so there are no obvious dead ends.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/MrDadpool/wireshark-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server