Skip to main content
Glama
cerby0n

Tshark MCP Server

by cerby0n
OverviewSchemaRelated ServersScoreDiscussions
JavaScript

Server Quality Checklist

58%
Profile completionA complete profile improves this server's visibility in search results.

  • Latest release: v1.0.0

  • Disambiguation4/5

    Each tool has a distinct focus: general attack detection, custom queries, overall stats, and detailed DNS tunneling investigation. However, the general attack analysis in 'analyze_pcap_attacks' could overlap with the DNS tunneling investigation, creating slight ambiguity for agents that might pick the wrong tool for a specific subtask.

    Naming Consistency5/5

    All tool names follow a consistent 'verb_noun' pattern in snake_case (e.g., analyze_pcap_attacks, query_pcap, get_pcap_stats, investigate_dns_tunneling), making it easy to predict functionality.

    Tool Count5/5

    With only 4 tools, the server is well-scoped for pcap analysis. Each tool serves a clear purpose: statistics, custom queries, general attack detection, and specialized DNS tunneling investigation. No tool feels redundant or missing given the domain.

    Completeness4/5

    The tool set covers core pcap analysis tasks: statistics, custom queries, generic attack detection, and deep forensic investigation of DNS tunneling. A potential gap is the lack of a tool for direct file upload or results export, but 'query_pcap' with Wireshark syntax provides flexible extraction. Overall, it's reasonably complete for security analysis.

  • Average 3.5/5 across 4 of 4 tools scored. Lowest: 2.9/5.

    See the Tool Scores section below for per-tool breakdowns.

    • 0 of 1 community issues answered or closed in the last 6 months
    • 0 commits in the last 12 weeks
    • No stable releases found
    • No critical vulnerability alerts
    • No high-severity vulnerability alerts
    • No code scanning findings
    • CI status not available

  • Add a LICENSE file by following GitHub's guide. Once GitHub recognizes the license, the system will automatically detect it within a few hours.

    If the license does not appear after some time, you can manually trigger a new scan using the MCP server admin interface.

    MCP servers without a LICENSE cannot be installed.

  • This repository includes a README.md file.

  • No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.

    Tip: use the "Try in Browser" feature on the server page to seed initial usage.

  • Add a glama.json file to provide metadata about your server.

  • If you are the author, simply .

    If the server belongs to an organization, first add glama.json to the root of your repository:

    {
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}

    Then . Browse examples.

  • Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

  • Behavior2/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    With no annotations, the description carries full burden but only says 'run a custom tshark query' without disclosing output format, side effects (presumably read-only), or limitations.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness4/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Two concise sentences that front-load the core action and add a syntax tip. No unnecessary words.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness2/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given no output schema, the description omits return value information. It also lacks usage context relative to siblings, making it incomplete for an agent to fully understand capabilities.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema has 100% coverage with clear descriptions. The description adds minimal value, only restating that display filters use Wireshark syntax and that fields are optional.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose4/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states it runs custom tshark queries with display filters and field extraction, which differentiates it from sibling tools like analyze_pcap_attacks or get_pcap_stats that have more specific purposes.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No guidance is given on when to use this tool vs siblings. It implies usage for custom queries but does not explain when to choose it over pre-built analyses.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    With no annotations, description carries full burden. It lists return types but does not mention side effects, resource usage, permissions, or whether the tool modifies data. Behavior is implied but not fully transparent.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Two sentences with no fluff; front-loaded purpose and concise enumeration of outputs. Every word earns its place.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given the tool's simplicity (one parameter, no output schema), the description adequately covers output types. Could mention limitations like file size or processing time, but overall sufficient for an agent.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema coverage is 100% with a clear parameter description. The tool description does not add meaning beyond repeating 'pcap_path' as the path, so no extra value; baseline score of 3 applies.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    Description clearly states the tool analyzes pcap files for security threats and lists specific outputs (suspicious IPs, port scans, etc.), which distinguishes it from sibling tools like query_pcap or get_pcap_stats.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No explicit guidance on when to use this tool versus alternatives; only implicitly suggests use for general attack analysis. Lacks when-not-to-use or context for selecting among siblings.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior2/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations are present, and the description provides no behavioral details such as permissions needed, side effects, or error conditions. It only states what the tool does without disclosing traits like read-only nature or potential limitations.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is a single, front-loaded sentence with no unnecessary words. Every part serves to convey the tool's function efficiently.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given the tool's simplicity (one parameter, no output schema), the description covers the main outputs (packet counts, protocols, conversations) adequately. It lacks details on return format but is sufficient for the tool's scope.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    The only parameter, pcap_path, is described adequately in the schema. The description adds no extra meaning beyond 'pcap file', so with 100% schema coverage, the baseline score of 3 is appropriate.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states the tool 'Get general statistics about a pcap file', listing specific content like packet counts, protocols, and conversations. It distinguishes well from siblings such as analyze_pcap_attacks, query_pcap, and investigate_dns_tunneling, which have different focuses.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines3/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The description implies use for obtaining general statistics, but lacks explicit guidance on when to use this tool versus its siblings. No exclusions or alternative recommendations are provided.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations are provided, so the description carries full burden. It discloses some behaviors (e.g., OS fingerprinting via TTL, entropy analysis) but does not mention read-only nature, required permissions, or any side effects.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Two sentences, front-loaded with purpose, no unnecessary words. Efficiently conveys core function and key features.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given 2 simple parameters and no output schema, the description adequately covers what the tool does and what it returns (attack characteristics). It could optionally detail return structure but is sufficient for the complexity.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema coverage is 100% with both parameters described. The description adds no additional meaning beyond listing capabilities; it does not elaborate on how parameters affect the investigation.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states 'Perform detailed DNS tunneling investigation' and lists specific outputs (attack characteristics, starting packet, source IP, OS fingerprinting via TTL, entropy analysis). This distinguishes it from sibling tools like analyze_pcap_attacks (broader) or query_pcap (generic querying).

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines4/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The phrase 'Perfect for forensic investigations' suggests appropriate context. However, it does not explicitly state when not to use (e.g., for non-DNS-tunneling traffic) or name alternatives like sibling tools.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

  • Confirm that the MCP server is working as expected.
  • Confirm that there are no obvious security issues.
  • Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

tshark-mcp MCP server

Copy to your README.md:

Score Badge

tshark-mcp MCP server

Copy to your README.md:

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/cerby0n/tshark-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server