Wireshark is a network protocol analyzer that allows users to capture and examine data traveling across a network. It's widely used for network troubleshooting, analysis, software development, and education.
A comprehensive security testing MCP server providing 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment. It enables automated security audits and technical investigations across web applications, cloud environments, and network captures.
51
42 npm
26
MIT
Why this server?
Allows streaming packet captures from EVE-NG PRO nodes to a local Wireshark for live analysis, without requiring direct SSH access to the EVE-NG host.
MCP server for controlling EVE-NG network emulator instances via REST API, enabling lab/node/network management, topology editing, and device operations through natural language.
36
1
MIT
Why this server?
Provides tools for capturing live network traffic and analyzing capture files using Wireshark's tshark, dumpcap, and capinfos, including packet summaries, protocol hierarchies, conversations, endpoints, expert info, IO stats, and stream reassembly.
Enables local LLM clients to capture and analyze network traffic using Wireshark's CLI tools, providing packet summaries, protocol hierarchies, conversations, endpoints, expert info, and stream reassembly without shell access.
12
MIT
Why this server?
Uses Wireshark's tshark dissectors to deeply decode PCAP/PCAPNG files, extracting DNS answers, HTTP requests, TLS SNI hostnames, USBPcap, and RFCOMM fields.
Enables AI assistants to capture and analyze network, PCAP, USB, and Bluetooth packet data through Scapy, tshark/Wireshark, and USBPcap, returning structured JSON for network debugging and hardware reverse engineering.
6
MIT
Why this server?
Generates Wireshark Lua dissectors from an inferred USB protocol, so captured traffic is displayed as named commands with decoded values, counters, lookup labels, and checksum checks (filterable via tshark/Wireshark), and parses Wireshark/USBPcap pcapng captures as input for protocol inference.
Reverse engineer Windows-only USB gadgets: capture vendor-app traffic, infer the protocol with frame-level evidence, and generate an open Python/pyusb driver. Replay needs human confirmation.
9
2
MIT
Why this server?
Enables packet capture and analysis through Wireshark/tshark integration, allowing the agent to start recording network traffic, analyze packet contents, apply filters, decrypt SSL/TLS traffic, and troubleshoot network issues
A Model Context Protocol server that provides network packet capture and analysis capabilities through Wireshark/tshark integration, enabling AI assistants to perform network security analysis and troubleshooting.
4
35
MIT
Why this server?
Provides network packet capture analysis capabilities similar to Wireshark's capinfos utility, enabling analysis of PCAP files for DNS, DHCP, ICMP, and TCP protocols with metadata extraction and packet statistics.
Enables LLMs to analyze network packet captures (PCAP files) from local or remote sources through a modular architecture. Supports DNS traffic analysis with structured JSON responses for network security and troubleshooting tasks.
9
121 PyPI
53
MIT
Why this server?
Provides tools for loading and analyzing PCAP/PCAPNG files using Wireshark's sharkd, enabling AI agents to inspect network packets, conversations, protocol statistics, and more.
Enables LLMs to load and analyze PCAP/PCAPNG files using Wireshark's sharkd interface, supporting packet inspection, traffic structure, conversations, and protocol statistics through natural language.
30
78
MIT
Why this server?
Suggested as a tool for analyzing network traffic to extract Eufy RoboVac device credentials.
A Model Context Protocol server for controlling Eufy RoboVac vacuum cleaners, enabling users to scan for devices, connect to them, and execute various cleaning commands through natural language.
