Integrates AbuseIPDB and URLhaus threat intelligence for IP reputation checks and PCAP-wide threat scanning.
Provides packet capture, deep protocol analysis, stream reconstruction, expert info, TLS decryption, and traffic export using Wireshark/TShark.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@NetMCP scan my local network for open ports"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Professional-grade network analysis MCP server — Wireshark/TShark + Nmap + Threat Intelligence
NetMCP bridges the gap between raw network data and AI comprehension. It gives Claude, Cursor, and any MCP-compliant client the ability to capture packets, scan networks, detect threats, and extract credentials — all through natural language.
Quick Start • Features • Configuration • API Reference • Architecture
# Install system dependencies
sudo apt-get install -y tshark nmap # Ubuntu/Debian
# brew install wireshark nmap # macOS
# Install NetMCP
pip install netmcp
# Run
netmcpThat's it. The server starts on stdio transport by default, ready for any MCP client.
Related MCP server: Wireshark MCP
📡 Packet Capture — Live capture, BPF filtering, targeted traffic, quick capture mode
🔬 Deep Analysis — PCAP parsing, protocol statistics, HTTP traffic analysis, DNS analysis, expert info, GeoIP enrichment
🔄 Stream Reconstruction — Follow TCP/UDP conversations, enumerate streams
📤 Flexible Export — JSON, CSV, pcap/pcapng format conversion
🔍 Nmap Integration — Port scan, service detection, OS fingerprinting, vulnerability scan
🛡️ Threat Intelligence — URLhaus + AbuseIPDB IP reputation checks, PCAP-wide threat scan
🔑 Credential Extraction — HTTP Basic, FTP, Telnet, Kerberos (hashcat-ready)
🌍 GeoIP Mapping — MaxMind GeoLite2 IP geolocation for traffic analysis
🔒 5-Layer Security — Input validation, shell=False, rate limiting, path traversal protection, audit logging
💬 Guided Workflows — Security audit, incident response, troubleshooting, traffic analysis, network baseline prompts
🔀 PCAP Diff/Merge/Slice — Compare captures, combine files via mergecap, extract packet ranges via editcap
📊 Flow Visualization — ASCII art and Mermaid sequence diagrams of network conversations
🔓 TLS Decryption — Decrypt HTTPS traffic using SSLKEYLOGFILE (NSS Key Log Format)
🎨 Wireshark Profiles — List profiles, apply profile settings, parse color filters, capture with profile
🧬 DNS Tunneling Detection — Analyze DNS traffic and flag suspiciously long subdomain names
📦 Packet Decode — Detailed single-packet analysis with full protocol layer dissection
🏥 Expert Information — Extract Wireshark's expert warnings, errors, and protocol violation notes
NetMCP provides 48 tools across 9 categories, plus 3 resources and 5 prompts:
Category | Tools | Description |
📡 Capture & Analysis | 5 |
|
🔬 Protocol Analysis | 10 |
|
📊 Network Flows | 2 |
|
🔧 PCAP Tools | 4 |
|
🔄 Streams | 3 |
|
📤 Export | 3 |
|
🔍 Nmap | 6 |
|
🛡️ Security | 3 |
|
🎨 Wireshark Profiles | 4 |
|
📖 Full API reference with parameters and examples: docs/API.md
NetMCP supports all MCP transport protocols:
Transport | Command | Use Case |
stdio (default) |
| Claude Desktop, Cursor, local clients |
SSE |
| Web-based clients, remote access |
Streamable HTTP |
| Modern HTTP clients |
Edit your config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json
{
"mcpServers": {
"netmcp": {
"command": "netmcp",
"env": {
"ABUSEIPDB_API_KEY": "your_api_key_here"
}
}
}
}Edit .cursor/mcp.json in your project root:
{
"mcpServers": {
"netmcp": {
"command": "netmcp"
}
}
}Edit .vscode/mcp.json:
{
"servers": {
"netmcp": {
"command": "netmcp",
"env": {
"ABUSEIPDB_API_KEY": "your_api_key_here"
}
}
}
}Variable | Required | Default | Description |
| No | — | AbuseIPDB API key for threat intelligence. Get free key |
| No | Auto-detect | Custom path to tshark binary |
| No |
| Maximum packets per capture operation |
| No |
| Maximum PCAP file size in bytes (100 MB) |
Dependency | Required | Install |
Python | 3.11+ |
|
TShark | Yes |
|
Nmap | Optional |
|
brew install wireshark nmap# Option 1: Set capabilities (recommended)
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
# Option 2: Add user to wireshark group
sudo usermod -aG wireshark $USER && newgrp wiresharkNetMCP implements 5 layers of defense in depth:
Layer | Mechanism | Prevents |
1. Input Validation | Regex, | Malformed input, injection payloads |
2. Command Construction | List args, | Command injection, shell expansion |
3. Subprocess Execution | Timeouts, captured output only | Runaway processes, resource exhaustion |
4. File System |
| Path traversal, symlink attacks |
5. Rate Limiting | Sliding window, per-operation tracking | Abuse, DoS attacks |
Additional protections:
🔒 Never auto-escalates privileges
📝 All operations audit-logged with timestamps
🚫 Dangerous nmap flags rejected (--script-args, --interactive, etc.)
⚠️ Clear error messages for permission issues
You: Capture 100 packets from eth0 and analyze the protocols.
Claude: [capture_live_packets(interface="eth0", packet_count=100)]
[get_protocol_statistics(filepath="capture.pcap")]
Found 8 protocols: TCP (62%), UDP (24%), DNS (8%), HTTP (4%)...You: Perform a security audit on suspicious.pcap
Claude: 1. [get_protocol_statistics] → traffic breakdown
2. [extract_credentials] → found HTTP Basic Auth credentials
3. [scan_capture_for_threats] → 2 malicious IPs detected
4. Generated full security report with IOCsYou: Scan 192.168.1.100 for vulnerabilities
Claude: [nmap_quick_scan("192.168.1.100")] → ports 22, 80, 443 open
[nmap_service_detection("192.168.1.100")] → nginx 1.18.0, OpenSSH 8.2
[nmap_vulnerability_scan("192.168.1.100")] → no critical CVEs foundURI | Description |
| Dynamic list of available network interfaces |
| Available PCAP files in common directories |
| System capabilities: tool versions, features |
Prompt | Description |
| Comprehensive PCAP security analysis with IOC extraction |
| Step-by-step network diagnostics |
| Security incident investigation workflow |
| Deep traffic analysis with GeoIP mapping |
| Establish normal traffic patterns |
# Clone and setup
git clone https://github.com/cortexc0de/netmcp.git
cd netmcp
python -m venv .venv
source .venv/bin/activate
# Install with dev dependencies
pip install -e ".[dev]"
# Run tests
pytest tests/ -v
# Run with coverage
pytest tests/ --cov=netmcp --cov-report=html
# Linting
ruff check src/netmcp/ tests/
ruff format --check src/netmcp/
mypy src/netmcp/src/netmcp/
├── server.py # FastMCP server entry point
├── core/
│ ├── security.py # 5-layer input validation + rate limiting
│ └── formatter.py # MCP response formatting
├── interfaces/
│ ├── tshark.py # TShark async CLI wrapper
│ ├── nmap.py # python-nmap wrapper
│ └── threat_intel.py # URLhaus + AbuseIPDB clients
├── tools/ # 48 MCP tools across 11 modules
├── resources/ # 3 MCP resources
└── prompts/ # 5 MCP promptsContributions are welcome! See CONTRIBUTING.md for guidelines.
Fork the repository
Create a feature branch (git checkout -b feat/amazing-feature)
Run tests (pytest tests/ -v)
Submit a Pull Request
MIT License — see LICENSE for details.
Wireshark/TShark — packet analysis toolkit
Nmap — network scanner
Model Context Protocol — AI tool framework
Transform your network analysis with AI-powered packet capture, scanning, and threat intelligence.
Analyze DNS queries and responses from a PCAP file.
Extracts DNS query names, types, response codes, and identifies potential DNS tunneling or suspicious patterns.
Args: filepath: Path to PCAP/PCAPNG file max_queries: Maximum number of DNS rows to process
Inputs: filepath (required), max_queries.
Analyze HTTP headers from a PCAP file — tokens, cookies, auth headers.
Extracts:
Cookies and session tokens
Authorization headers (Bearer, API keys)
Custom security headers
Suspicious headers (X-Forwarded-For spoofing)
Args: filepath: Path to PCAP/PCAPNG file include_cookies: Whether to include cookie analysis
Inputs: filepath (required), include_cookies.
Analyze HTTP traffic from a PCAP file.
Extracts HTTP methods, hosts, URIs, user agents, and response codes.
Args: filepath: Path to PCAP/PCAPNG file
Inputs: filepath (required).
Analyze a large PCAP file in chunks for memory efficiency.
Processes packets in batches, accumulating statistics.
Args: filepath: Path to PCAP/PCAPNG file chunk_size: Number of packets per processing chunk display_filter: Optional Wireshark display filter ctx: Optional MCP context for progress reporting
Inputs: filepath (required), chunk_size, display_filter.
Analyze a PCAP file with optional display filters.
Args: filepath: Path to PCAP/PCAPNG file display_filter: Wireshark display filter (e.g., 'http', 'ip.addr == 10.0.0.1') max_packets: Maximum number of packets to analyze
Inputs: filepath (required), display_filter, max_packets.
Analyze a PCAP file using a specific Wireshark profile.
Args: filepath: Path to PCAP/PCAPNG file profile_name: Wireshark profile name to apply display_filter: Optional Wireshark display filter max_packets: Maximum packets to return
Inputs: filepath (required), profile_name (required), display_filter, max_packets.
Capture live network packets from a specified interface.
Args: interface: Network interface name (e.g., eth0, en0, Wi-Fi) duration: Maximum capture duration in seconds packet_count: Maximum number of packets to capture bpf_filter: BPF capture filter (e.g., 'tcp port 80')
Inputs: interface (required), duration, packet_count, bpf_filter.
Capture traffic targeted to specific host, port, or protocol.
Args: interface: Network interface name target_host: Filter by host IP (optional) target_port: Filter by port number (optional) protocol: Filter by protocol (tcp, udp, icmp, http) duration: Max capture duration in seconds packet_limit: Maximum packets to capture ctx: Optional MCP context for progress reporting
Inputs: interface (required), target_host, target_port, protocol, +2 more.
Live capture using a Wireshark profile's configuration.
Args: interface: Network interface name (e.g., eth0, en0) profile_name: Wireshark profile name to apply duration: Capture duration in seconds packet_count: Maximum number of packets
Inputs: interface (required), profile_name (required), duration, packet_count.
Check an IP address against threat intelligence feeds.
Args: ip_address: IP address to check providers: Comma-separated providers (urlhaus, abuseipdb)
Inputs: ip_address (required), providers.
Convert a PCAP file between pcap and pcapng formats.
Args: filepath: Path to source PCAP file output_format: Target format: pcap or pcapng
Inputs: filepath (required), output_format.
Decode a single packet in full detail.
Args: filepath: Path to PCAP file packet_number: Packet number to decode (1-based) verbose: If True, return verbose text decode; if False, return JSON layers hex_dump: If True, include hex and ASCII dump of raw packet bytes (-x flag)
Inputs: filepath (required), packet_number (required), verbose, hex_dump.
Decrypt TLS/HTTPS traffic using an SSLKEYLOGFILE.
Requires a TLS key log file (NSS Key Log Format) captured alongside the traffic. Set SSLKEYLOGFILE env var or pass keylog_file explicitly.
Args: filepath: Path to PCAP/PCAPNG file containing TLS traffic keylog_file: Path to TLS key log file (NSS format) output_file: Optional path to write decrypted pcapng
Inputs: filepath (required), keylog_file, output_file.
Deep packet analysis with protocol breakdown, layer details, and markdown tables.
Args: file_path: Path to PCAP/PCAPNG file count: Maximum number of packets to analyze display_filter: Optional Wireshark display filter
Inputs: file_path (required), count, display_filter.
Detect and report network protocols in use.
Args: filepath: Path to existing PCAP file (optional) interface: Network interface for live capture (if no file) duration: Duration in seconds for live capture
Inputs: filepath, interface, duration.
Compare two PCAP files and report differences.
Args: filepath1: Path to first PCAP file filepath2: Path to second PCAP file display_filter: Optional Wireshark display filter applied to both
Inputs: filepath1 (required), filepath2 (required), display_filter.
Export packet fields from a PCAP as CSV with proper headers using tshark -E flags.
Args: filepath: Path to PCAP/PCAPNG file fields: Comma-separated field names (default: standard fields including column fields) display_filter: Wireshark display filter separator: CSV field separator character (default: comma)
Inputs: filepath (required), fields, display_filter, separator.
Export packets from a PCAP file as structured JSON.
Args: filepath: Path to PCAP/PCAPNG file display_filter: Wireshark display filter max_packets: Maximum packets to export
Inputs: filepath (required), display_filter, max_packets.
Extract potential credentials from a PCAP file.
Scans for:
HTTP Basic Authentication headers
FTP USER/PASS commands
Telnet login/password prompts
Kerberos AS-REQ/AS-REP hashes (crackable with hashcat)
Args: filepath: Path to PCAP/PCAPNG file
Inputs: filepath (required).
Extract files from HTTP/SMB/DICOM/IMF/TFTP streams using tshark.
Args: file_path: Path to PCAP/PCAPNG file protocol: Protocol to extract objects from (http, smb, dicom, imf, tftp) output_dir: Directory to write extracted files (created if empty)
Inputs: file_path (required), protocol, output_dir.
Reconstruct a TCP conversation from a PCAP file.
Args: filepath: Path to PCAP/PCAPNG file stream_index: Index of the TCP stream to follow (0-based) format: Output format: ascii, hex, or raw
Inputs: filepath (required), stream_index, output_format.
Reconstruct a UDP conversation from a PCAP file.
Args: filepath: Path to PCAP/PCAPNG file stream_index: Index of the UDP stream to follow (0-based) output_format: Output format: ascii, hex, or raw
Inputs: filepath (required), stream_index, output_format.
Generate a comprehensive analysis report in markdown or HTML.
Args: file_path: Path to PCAP/PCAPNG file report_format: Output format — 'markdown' or 'html' sections: Comma-separated list of sections to include
Inputs: file_path (required), report_format, sections.
Look up geographic information for IP addresses.
Can check specific IPs or extract all from a PCAP file.
Args: ip_addresses: Comma-separated IP addresses (e.g., '1.1.1.1,8.8.8.8') filepath: PCAP file to extract IPs from (optional, overrides ip_addresses if provided)
Inputs: ip_addresses (required), filepath.
Get metadata about a PCAP capture file.
Args: filepath: Path to PCAP/PCAPNG file
Inputs: filepath (required).
Get detailed capture file information using capinfos.
Args: file_path: Path to PCAP/PCAPNG file
Inputs: file_path (required).
Read Wireshark color filter rules from a profile or the default config.
Args: profile_name: Profile name (empty string uses default config)
Inputs: profile_name.
IP/TCP/UDP/Ethernet conversation statistics from a PCAP file.
Args: file_path: Path to PCAP/PCAPNG file conv_type: Conversation type (eth, ip, ipv6, tcp, udp) display_filter: Optional Wireshark display filter
Inputs: file_path (required), conv_type, display_filter.
Extract Wireshark expert information from a PCAP file.
Returns warnings, errors, and notes from Wireshark's expert system. Useful for identifying protocol violations, malformed packets, etc.
Args: filepath: Path to PCAP/PCAPNG file
Inputs: filepath (required).
Time-binned I/O statistics from a PCAP file.
Args: file_path: Path to PCAP/PCAPNG file interval: Time interval in seconds for binning (positive number) display_filter: Optional Wireshark display filter
Inputs: file_path (required), interval, display_filter.
List all available network interfaces for packet capture.
Inputs: no named parameters.
Get a quick packet summary similar to Wireshark's packet list view.
Uses column fields (_ws.col.*) for human-readable output.
Args: file_path: Path to PCAP/PCAPNG file count: Maximum number of packets to show (default: 20) display_filter: Optional Wireshark display filter
Inputs: file_path (required), count, display_filter.
Get protocol hierarchy statistics from a PCAP file.
Args: filepath: Path to PCAP/PCAPNG file
Inputs: filepath (required).
List all TCP conversations found in a PCAP file.
Args: filepath: Path to PCAP/PCAPNG file
Inputs: filepath (required).
List available Wireshark profiles and their configuration files.
Inputs: no named parameters.
Merge multiple PCAP files into one using mergecap.
Args: filepaths: List of PCAP file paths to merge output_file: Output file path (.pcap or .pcapng) chronological: Merge by timestamp (True) or append in order (False)
Inputs: filepaths (required), output_file (required), chronological.
Perform a quick packet capture (3 seconds, default interface).
A fast way to see what's happening on the network without configuration.
Args: interface: Network interface name (default: eth0) packet_count: Maximum packets to capture (default: 10)
Inputs: interface, packet_count.
Capture network traffic and save to a PCAP file.
Useful when you want to keep a capture for later analysis.
Args: interface: Network interface name output_file: Path where to save the PCAP file duration: Max capture duration in seconds packet_count: Max packets to capture bpf_filter: BPF capture filter (optional)
Inputs: interface (required), output_file (required), duration, packet_count, +1 more.
Extract all IPs from a PCAP file and check against threat feeds.
Args: filepath: Path to PCAP/PCAPNG file providers: Comma-separated providers (urlhaus, abuseipdb)
Inputs: filepath (required), providers.
Slice or filter a PCAP file using editcap.
Args: filepath: Path to input PCAP file output_file: Output file path (.pcap or .pcapng) start_packet: First packet number to keep (1-based) end_packet: Last packet number to keep start_time: Keep packets after this time (editcap -A format) end_time: Keep packets before this time (editcap -B format) remove_duplicates: Remove duplicate packets
Inputs: filepath (required), output_file (required), start_packet, end_packet, +3 more.
Generate visual diagrams of network flows from a PCAP file.
Produces ASCII art or Mermaid sequence diagrams showing packet exchanges between endpoints.
Args: filepath: Path to PCAP/PCAPNG file flow_type: Protocol type: tcp or udp max_flows: Maximum number of packet arrows to include (1-200) output_format: Diagram format: text or mermaid
Inputs: filepath (required), flow_type, max_flows, output_format.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 41 tools
Many tools have overlapping purposes, such as multiple analyze_pcap_file variants (analyze_pcap_file, deep_packet_analysis, get_packet_summary) and several capture tools (capture_live_packets, capture_targeted_traffic, quick_capture) that differ only slightly in parameters. This creates ambiguity for an agent trying to select the correct tool.
Tool names consistently use snake_case and follow a verb_noun pattern (e.g., analyze_dns_traffic, get_conversation_stats). However, the set of verbs is diverse (analyze, capture, export, get, follow, etc.), which is acceptable but not perfectly uniform. Overall, naming is functional but not highly predictable.
With 41 tools, the surface is overly large for typical network analysis needs. Many tools are redundant (e.g., three capture functions for similar purposes) or overly specialized. A smaller, more focused set would reduce complexity without sacrificing capability.
The tool set covers a broad range of network analysis: capture, analysis, export, threat intel, visualization, and conversion. However, there are notable gaps, such as no tools for modifying packets, wireless capture, or advanced protocol analysis beyond basic HTTP/DNS. Some core workflows are covered but with excessive redundancy.
Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.
One MCP server for all web data. Scrape, search, crawl, and AI research in one install.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
