Skip to main content
Glama
deenesjakoruzh
swannman

arkime-mcp-server

by swannman
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

arkime-mcp-server

An MCP server for Arkime full packet capture. Lets AI assistants search network sessions, investigate traffic patterns, and monitor capture health.

Tools

Tool

Description

search_sessions

Search sessions with Arkime expressions, returns source/dest IPs, ports, protocols, bytes, geo, and AS info

get_session_detail

Full decoded protocol detail for a single session

get_session_packets

Decoded packet data for a session

top_talkers

Top N values for any field by session count (hosts, ports, domains, etc.)

connections_graph

Network connection graph — nodes and links with byte/packet/session counts

unique_destinations

Distinct external IPs contacted by an internal host

dns_lookups

DNS queries captured in traffic, filterable by domain pattern or source IP

reverse_dns

PTR/reverse DNS lookup for an IP

external_connections

Sessions going to non-RFC1918 destinations, sorted by bytes

geo_summary

Destination traffic breakdown by country

capture_status

Arkime cluster health — node count, shard status, OpenSearch version

pcap_files

PCAP capture files with sizes, packet counts, and time ranges

list_fields

Available Arkime session fields for use in search expressions

Related MCP server: Android Proxy MCP

Setup

npm install
npm run build

Configuration

Set environment variables:

Variable

Required

Default

Description

ARKIME_URL

No

http://192.168.5.176:8005

Arkime viewer URL

ARKIME_USER

No

mcp

Arkime API username

ARKIME_PASSWORD

Yes

—

Arkime API password

Usage with Claude Code

Add to your MCP settings (e.g., .mcp.json):

{
  "mcpServers": {
    "arkime": {
      "command": "node",
      "args": ["/path/to/arkime-mcp-server/build/index.js"],
      "env": {
        "ARKIME_PASSWORD": "your-password"
      }
    }
  }
}

Authentication

Arkime uses HTTP Digest authentication. The server handles this via the digest-fetch library.

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • TShark2MCP

    niusulong
    A
    license
    Not graded
    quality
    B
    maintenance
    An MCP server that enables AI-assisted network packet analysis using Wireshark's TShark tool. It provides tools for pcap file overview, session extraction, protocol filtering, and statistical analysis through a standardized interface.
    1
    MIT

  • Android Proxy MCP

    zhizhuodemao
    A
    license
    A
    quality
    F
    maintenance
    An MCP server that enables AI assistants to capture and analyze HTTP/HTTPS traffic from Android devices. It supports smart searching of network requests and provides tools for detailed traffic analysis via natural language.
    11
    231
    MIT

  • tshark-mcp

    ouonet
    A
    license
    A
    quality
    D
    maintenance
    An MCP server that exposes TShark as tools for AI-assisted network packet analysis, supporting PCAP analysis, live capture, TLS decryption, and telecom/SS7 signaling protocols.
    25
    1
    MIT

  • Wireshark MCP Server

    iflow-mcp
    A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive MCP server that provides AI assistants with professional-grade network analysis capabilities, combining Wireshark packet analysis, nmap scanning, and threat intelligence for enhanced network troubleshooting and security analysis.
    MIT