mcp-wireshark
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_installationA | Check if Wireshark/tshark is installed and return version info. |
| list_interfacesA | List all network interfaces available for packet capture. |
| read_pcapA | Read and analyze packets from a .pcap or .pcapng file. Returns a preview of up to 5 packets in JSON plus the total match count. |
| display_filterA | Apply a Wireshark display filter to a pcap file and return a preview of matching packets. |
| summarize_pcapA | Get a high-level summary of a pcap file: I/O stats, protocol hierarchy, and top IP conversations. Prefer this over read_pcap when the goal is to characterize a capture. |
| stats_by_protoB | Generate the protocol hierarchy statistics for a pcap file. |
| follow_tcpA | Follow a TCP stream by index and return its ASCII payload. |
| follow_udpA | Follow a UDP stream by index and return its ASCII payload. |
| expert_infoA | Run tshark expert analysis on a pcap file. Returns warnings, errors, and notes grouped by severity. Useful for diagnosing protocol issues without reading individual packets. |
| decode_protocolA | Extract protocol-specific fields from a pcap file using tshark '-T fields'. Pass a known protocol name to use curated defaults (supported: dns, goose, http, icmp, mms, sip, sv, tls), or supply your own 'fields' list for any other protocol. Returns a tab-separated table — much smaller than full JSON. Use a 'filter' to narrow results (e.g. only request packets, only specific stNum values). |
| protocol_statsA | Run a tshark '-z' aggregate-statistics report on a pcap file and return its parsed output. Use this for protocol-hierarchy, conversation, endpoint, and per-protocol stat tables — much more compact than per-packet JSON. Supported (protocol, variant) pairs: conv: eth, ip, ipv6, tcp, udp; dns: tree; endpoints: eth, ip, ipv6, tcp, udp; http: stat, tree; http_req: tree; io: phs, stat; rpc: srt; sip: stat; smb: srt; smb2: srt. |
| analyze_iec61850A | Analyze an IEC 61850 capture for protocol health and return a compact, worst-first OK/WARN/FAIL report per source. protocol is one of 'goose' (stNum/sqNum gaps, timeAllowedtoLive violations, state-change storms), 'sv' (smpCnt continuity, loss of time sync, confRev changes), or 'mms' (error/reject PDUs, unpaired requests, slow responses). Scans the whole capture but returns only a bounded summary, so it is safe on high-rate SV streams. |
| live_captureA | Capture live network traffic from an interface. Writes to a temporary pcap that is deleted after the preview is returned. |
| export_jsonA | Export packets from a pcap file to a JSON file at output_path. Creates the output file if it does not exist; overwrites if it does. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Several tools have overlapping functionality: stats_by_proto and protocol_stats both provide protocol hierarchy; summarize_pcap includes protocol hierarchy and conversations, overlapping with protocol_stats and read_pcap. decode_protocol, read_pcap, and display_filter all provide packet detail views. This overlap can cause ambiguity in tool selection.
All tool names follow a consistent verb_noun pattern (e.g., check_installation, decode_protocol, follow_tcp, list_interfaces). No mixing of styles like camelCase or underscores-only, making the naming predictable and easy to understand.
14 tools is well-scoped for a Wireshark-based analysis server. It covers installation checks, live capture, interface listing, various packet analysis methods, stream following, statistics, and export—all core needs without unnecessary bloat.
The tool set covers most common pcap analysis tasks: reading, filtering, decoding, expert analysis, statistics, stream following, and export. Minor gaps include lack of a tool to save filtered captures as pcap or to merge captures, but overall the surface is sufficient for typical workflows.