packet-chef-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PORT | No | The port for the HTTP/SSE server (default is 8080) | 8080 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| packet_summaryA | High-density L3–L7 triage summary (<2KB JSON). Fast reconnaissance of packet totals, talkers, DNS/HTTP/TLS volumes, and warnings for unparsed enterprise protocols (SMB, Kerberos, SSH). |
| packet_listC | Returns a paginated list of packet summary records from a PCAP capture. Enforces strict LLM context limits with default limit 20 and max 100. |
| packet_extract_conversationsA | Aggregates and tracks bidirectional 5-tuple conversations (src/dst IP, ports, protocol). Computes sent/received packet and byte counts, duration, and TCP flag lifecycles (SYN/ACK/FIN/RST). Ranked by total bytes transferred. |
| packet_extract_dnsB | Extracts and parses DNS queries and responses (RFC 1035) with label pointer loop protection. Aggregates query counts, unique domain rankings, and transaction details (A, AAAA, CNAME, TXT, MX, PTR). |
| packet_extract_httpA | Reassembles TCP streams and extracts HTTP/1.x requests and responses. Parses method, URI, headers, status codes, chunked transfers, body previews (4KB cap), and cognitive guidance hints. |
| packet_extract_tls_sniB | Extracts Server Name Indication (SNI) hostnames and client metadata from TLS ClientHello handshakes. Ranks accessed domains by frequency without decrypting payload data. |
| packet_detect_beaconsB | Detects periodic C2 beacon communications using statistical time-delta variance (Coefficient of Variation, jitter %, median interval). Filters benign infrastructure (NTP, cloud IMDS, public resolvers) with confidence ratings (HIGH/MEDIUM/LOW). |
| packet_detect_dns_tunnelingA | Identifies DNS data exfiltration and tunneling channels (e.g. dnscat2, iodine, Cobalt Strike DNS beacons). Analyzes Shannon character entropy, subdomain label lengths, character set encodings (hex/base32/base64), and CDN heuristics. |
| packet_extract_credentialsA | Hunts for cleartext and recoverable credentials in HTTP Basic / Digest headers, URL query parameters, form/JSON POST bodies, FTP USER/PASS commands, and SMTP authentication. |
| packet_entropyB | Calculates Shannon entropy (0.0 to 8.0 bits/byte) to evaluate payload randomness and distinguish between plaintext, structured data (JSON/HTML/code), and encrypted / compressed malware or C2 traffic. |
| packet_ja3_fingerprintsA | Extracts and aggregates JA3, JA3S, and JA4 TLS client fingerprints across the capture. Correlates hashes against known C2 frameworks (Cobalt Strike, Metasploit, Sliver) and automation tools. |
| packet_extract_websocketB | Reassembles TCP streams and parses RFC 6455 WebSocket frames, unmasking client payloads and decoding text/JSON messages for persistent C2 or chat triage. |
| packet_extract_quic_sniA | Extracts SNI hostnames, ALPN tags, and Connection IDs (DCID/SCID) from QUIC v1 / HTTP/3 Initial packets over UDP (port 443) via RFC 9001 Section 5.2 Initial Secret AEAD decryption. |
| packet_filter_exportB | Filters PCAP/PCAPng traffic by IP address, port, protocol, or time window and exports a clean, RFC-compliant classic PCAP binary (base64 or saved to disk). |
| packet_to_zeek_logsA | Exports connection, DNS, and HTTP events formatted in Zeek-compatible TSV schema (conn.log, dns.log, http.log) for SIEM ingestion into Splunk, ELK, or Wazuh. (Note: Generates TSV schemas, does not execute Zeek scripting engine). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 15 tools
Each tool targets a distinct packet-analysis task: high-level summary/list versus protocol-specific extraction versus detection versus export. The only mild conceptual overlap, packet_summary and packet_list, is clearly resolved by their descriptions.
All names use snake_case with a consistent packet_ prefix, which makes the set easy to scan. Some names are verb-led (packet_extract_*, packet_detect_*) while others are noun-led (packet_summary, packet_entropy, packet_ja3_fingerprints), so the pattern is slightly mixed.
15 tools is at the top of the recommended range but each covers a distinct packet-analysis capability, from triage to protocol extraction to detection to export. There are no redundant placeholder tools or obviously missing core functions.
The surface covers core PCAP triage, extraction (DNS/HTTP/TLS/QUIC/WebSocket), detection (beacons/DNS tunneling), credentials, entropy, filtering, and Zeek export. It warns about unparsed enterprise protocols such as SMB, Kerberos, and SSH but offers no extraction tools for them, which is a minor workaround gap.