Skip to main content
Glama

packetsniffer-mcp

MCP server for local network packet capture and PCAP file analysis.

Stack: Python 3.12+ · FastMCP 3.4 · FastAPI · prefab-ui · Multi-provider LLM · Sampling · CodeMode (--agentic)

What can I do with this?

A network debugger you can ask questions of. The agent drives Scapy via one portmanteau tool (packetsniffer_ops) instead of you wrangling Wireshark/tshark:

Scenario

Call

"What is in this capture file?" — analyze any .pcap/.pcapng (yours, a colleague's, a router export). No admin needed.

packetsniffer_ops(operation="analyze_pcap", file_path="C:/captures/router.pcap")

"What is phoning home?" — watch DNS queries to find which app contacts which domain. Pass save_path to keep the raw capture as evidence.

packetsniffer_ops(operation="sniff", filter_expr="udp port 53", count=200, timeout=120, save_path="C:/captures/dns.pcap")

"Watch it in the background" — start a capture, don't block the agent. Poll, then collect. Survives across agent sessions in HTTP daemon mode.

start_capture → capture_status → stop_capture

"Decode it deeply" — after a capture, extract decoded fields Scapy misses: full DNS answers, HTTP requests, and TLS SNI hostnames (catches encrypted phone-home domains). Requires tshark (ships with Wireshark).

packetsniffer_ops(operation="decode_pcap", file_path="C:/captures/dns.pcap", limit=100)

"Why is my service unreachable?" — capture traffic to one port and see whether packets arrive at all, and how the TCP handshake behaves.

packetsniffer_ops(operation="sniff", filter_expr="tcp port 10813", count=30)

"What is on my network?" — list interfaces before capturing.

packetsniffer_ops(operation="list_interfaces")

"What bytes does this app send my USB device?" — pull the host-to-device data out of a USBPcap capture, with per-endpoint totals and any captured device/interface descriptors (printer class? HID? vendor-specific?). Pure Python, no tshark.

packetsniffer_ops(operation="usb_payloads", file_path="C:/captures/02-dot.pcap", export_path="C:/captures/02-dot.bin")

"What does it send over Bluetooth serial?" — RFCOMM (serial port profile) data from a Bluetooth HCI capture (btsnoop log from an Android phone, or Wireshark pcap/pcapng).

packetsniffer_ops(operation="btsnoop_payloads", file_path="C:/captures/btsnoop_hci.log")

"Which bytes encode the dot?" — diff two captures (blank label vs one-dot label): shared prefix/suffix, changed byte ranges, per-transfer differences.

packetsniffer_ops(operation="diff_captures", file_path="C:/captures/01-blank.pcap", file_path_b="C:/captures/02-dot.pcap")

"Capture USB while I operate the device" — wraps USBPcap's command line for a fixed duration. Unverified live (needs the USBPcap driver, administrator rights).

packetsniffer_ops(operation="usb_list_hubs") then packetsniffer_ops(operation="usb_capture", usb_hub="\\\\.\\USBPcap1", timeout=30, save_path="C:/captures/02-dot.pcap")

Results come back as structured JSON (flows, protocol mix, per-packet summaries) so the agent can interpret them directly — no pcap GUI needed.

Hardware reverse engineering (USB / Bluetooth):

  • usb_payloads, btsnoop_payloads and diff_captures work on files anywhere, with no privileges and no tshark. They are tested against synthetic captures, and when tshark is installed a test cross-checks the same files against Wireshark's own dissectors (USBPcap bus/device/endpoint/transfer type/payload, RFCOMM frame types, lengths and check bytes; verified with Wireshark 4.6.8). Not yet tested against a capture from real hardware.

  • usb_capture / usb_list_hubs drive USBPcapCMD.exe (winget install desowin.USBPcap; a capture driver, administrator rights, and a reboot before the driver attaches to the USB hubs). The flags used (-d, -o, -A, --devices, --inject-descriptors) match the real tool's --help (USBPcap 1.5.4.0). Orchestration is tested through a fake executable; a live capture has not been run yet.

  • Bluetooth: the capture must start before the device connects, or the L2CAP channel table is missing and only frames whose checksum verifies are kept. Classic Bluetooth cannot be sniffed from Windows; use an Android phone's HCI snoop log. Credit-based flow control bytes are handled; unusual RFCOMM streams may not decode.

  • Method and capture protocol: see the DYMO MobileLabeler plan in devices-mcp, docs/LABEL_PRINTER_REVERSE_ENGINEERING.md.

Limits / requirements:

  • analyze_pcap and decode_pcap work on files anywhere, no privileges.

  • decode_pcap needs tshark on PATH (ships with Wireshark — winget install Wireshark). Without it, the op returns a clean missing_dependency error, nothing else breaks.

  • Live sniff / start_capture require administrator privileges, and on Windows the Npcap driver (Wireshark's capture backend).

  • Loopback capture (127.0.0.1) is unreliable on Windows — this tool shines on WiFi/LAN/DNS traffic and offline capture files, not localhost webapp debugging.

  • Capture defaults are bounded: count max 1000, timeout max 300s. Raise the ceilings via PACKETSNIFFER_MCP_MAX_SNIFF_COUNT / PACKETSNIFFER_MCP_MAX_SNIFF_SECONDS for long-running captures.

  • Background captures live in the server process: run the HTTP daemon (start.ps1 / --http) for captures that outlive a single agent session. stop_capture takes effect on the next packet — with no traffic on the interface it finishes at the timeout.

Related MCP server: mcp-wireshark

Install

uv sync --extra dev
pre-commit install

Run

# stdio (Claude Desktop / Cursor)
uv run python -m packetsniffer_mcp

# HTTP + REST API (direct access)
uv run python -m packetsniffer_mcp --http --port 10920

# CodeMode agentic discovery
uv run python -m packetsniffer_mcp --agentic

# Dev launcher (auto-opens browser; `-Headless` to skip)
.\start.ps1

LLM Providers

Auto-detects local providers (Ollama on :11434, LM Studio on :1234). Configure via environment variables:

Variable

Purpose

PACKETSNIFFER_MCP_LLM_PROVIDER

ollama | lmstudio | openai | anthropic | google

PACKETSNIFFER_MCP_LLM_MODEL

Override model name

PACKETSNIFFER_MCP_LLM_API_KEY

API key (cloud providers)

Cloud providers detect their standard env vars: OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY.

API Endpoints (HTTP mode)

Method

Path

Description

GET

/health

Health check

GET

/api/v1/diagnostics

Full diagnostics (LLM, tools, system)

GET

/api/v1/tools

List all MCP tools

GET

/api/v1/providers

List LLM providers + presets

POST

/api/v1/chat

Chat with LLM (supports streaming)

Fleet Surface

Feature

Entry

Help

help tool

Status

status tool

Prefab card

packetsniffer_mcp_status_card

Chat

chat tool (multi-provider LLM)

Agentic

agentic_packetsniffer_mcp_workflow

Skills

resource://packetsniffer-mcp/skills

Capabilities

resource://packetsniffer-mcp/capabilities

CodeMode

--agentic or MCP_AGENTIC=1

License

MIT © 2026 MCP Studio

Available Tools

6 tools
agentic_packetsniffer_mcp_workflowC

Run a multi-step workflow using FastMCP sampling when the client supports it.

ParametersJSON Schema
NameRequiredDescriptionDefault
max_iterationsNo
available_toolsNo
workflow_promptYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral burden. It hints at FastMCP sampling and a fallback condition but omits crucial traits: whether the workflow mutates state, how iterations are bounded, permission/auth requirements, cost/latency implications, and what 'sampling' means operationally.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the key capability front-loaded. It is efficient, though almost too terse for a multi-step process. Given the complexity of the operation, the brevity edges into under-specification rather than pure conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need not be explained. However, for a complex multi-step, tool-using workflow with three undocumented parameters, no annotations, and no usage routing against five siblings, the description is far too thin to tell an agent how to invoke it correctly or safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for all three parameters. The description mentions no parameter behavior: it does not explain that workflow_prompt drives the sampling, that max_iterations bounds the loop, or what available_tools filters. With three undocumented params, the description fails to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a verb and resource ('Run a multi-step workflow'), which is clearer than a tautology, but 'workflow' is generic and the description gives no sense of what the workflow actually does or how it differs from sibling tool 'chat' or 'packetsniffer_ops'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only conditional is 'when the client supports it,' which is about capability, not task fit. There is no guidance on when to choose this over 'chat' or 'packetsniffer_ops', and no explanation of what happens when the client does not support FastMCP sampling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chatA
Read-only

Chat with the configured LLM provider (local or cloud).

Uses the unified LLM client which auto-detects local providers (Ollama, LM Studio) and supports cloud providers (OpenAI, Anthropic, Google Gemini) via API keys.

The provider and model can be overridden per-request.

Return Format

{"success": bool, "content": str, "model": str, "provider": str}

Examples

await chat(prompt="What is the capital of Austria?") await chat(prompt="Explain quantum computing in 3 sentences", system="Be concise.") await chat(prompt="Hello", provider="openai", model="gpt-4o") await chat(prompt="Describe Vienna", temperature=0.3)

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNoOverride model name.
promptYesThe message or question to send to the LLM.
systemNoOptional system prompt to set context.
providerNoOverride provider: ollama, lmstudio, openai, anthropic, google.
max_tokensNoMax tokens in response.
temperatureNoSampling temperature 0.0-2.0.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds genuinely useful behavior beyond that: provider auto-detection order for local runtimes, the API-key requirement for cloud providers, and per-request override semantics. It stops short of noting cost, latency, or rate-limit implications of cloud calls.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence, with provider mechanics second and examples last. The 'Return Format' block partially duplicates the output schema and is the one section that does not fully earn its place, but the examples themselves are compact and instructive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, explaining return values is optional and the restated format is a minor redundancy rather than a gap. The description covers provider resolution, overrides, and parameter usage sufficiently; only failure modes (no provider configured, invalid API key, provider unreachable) are left unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the examples meaningfully add value by showing how parameters compose (system prompt alongside prompt, provider+model override together, temperature tuning). That demonstrates the override precedence described in prose but not spelled out per-parameter in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (send a prompt to the configured LLM) and resource, then explains the underlying mechanism: a unified client that auto-detects local providers (Ollama, LM Studio) and supports cloud providers via API keys. Sibling tools (status, help, ops, workflow) are unrelated utility endpoints, so no sibling differentiation is required for an agent to pick correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is demonstrated through four concrete examples rather than stated explicitly; there is no 'use this when...' guidance or exclusion of alternatives. The mention of API keys for cloud providers is the only implicit prerequisite, and nothing tells the agent what happens when no provider is reachable. Adequate but with clear gaps for a tool whose behavior varies by environment.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

helpB

List capabilities and fleet surface for PacketsnifferMcp.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full behavioral burden. 'List' weakly implies a read-only operation, but there is no explicit statement about safety, side effects, authentication, or rate limits. The output schema covers return values, but behavioral traits are not disclosed beyond the verb.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the action and resource. It is appropriately sized for a zero-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (zero params) and has an output schema, so return details are not needed. However, the description never explains what 'fleet surface' means or how this tool relates to sibling status and status_card tools, leaving a clear contextual gap for an agent deciding when to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and schema coverage is 100%, so the rubric sets a baseline of 4. There are no parameters for the description to clarify, and the schema is trivially complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

State a specific verb 'List' and resource 'capabilities and fleet surface for PacketsnifferMcp', so an agent can tell it is a discovery/help tool. However, 'fleet surface' is undefined jargon and the description does not distinguish it from sibling tools like status or packetsniffer_mcp_status_card.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative tool guidance is provided. The name 'help' hints at discovery, but the description itself gives no explicit context for selecting this tool over status, packetsniffer_mcp_status_card, or others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

packetsniffer_mcp_status_cardB
Read-only

Server health as a Prefab card.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful output-format context ('Prefab card') but does not describe authentication, rate limits, or other behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It is slightly terse and lacks an explicit verb, but the structure is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only status tool with no output schema, the description provides enough context: it returns server health formatted as a Prefab card. Additional detail about card contents or call frequency could improve it, but the essentials are present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter semantics to explain. The baseline for a zero-parameter tool is 4, and the description does not need to compensate for any schema gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the resource (server health) and output form (a Prefab card), which distinguishes it from the sibling 'status' tool. The verb is implicit rather than explicit, but an agent can infer it retrieves a status card.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as 'status' or 'help'. The agent must infer usage from the name and description alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

packetsniffer_opsA

Network interface discovery, live packet capture, and PCAP analysis.

[RATIONALE] Consolidates local packet sniffing, background captures, and offline PCAP analysis tools to stay under tool limits while providing full companion hacking capability.

Operations:

  • list_interfaces: List active network interfaces with details.

  • sniff: Blocking capture for the given count/timeout (requires admin privileges). Pass save_path to persist the capture to a PCAP file for later analysis or evidence.

  • start_capture: Start a capture in the background (non-blocking). Returns a capture_id immediately; the capture runs in a server thread until count/timeout is reached or stop_capture is called. In HTTP daemon mode the capture survives across agent sessions. Poll with capture_status.

  • capture_status: Status of one capture (capture_id) or all active captures.

  • stop_capture: Request a stop (takes effect on the next packet, or at timeout). Returns packets captured so far; pass save_path to persist them.

  • decode_pcap: Deep protocol decode of a PCAP/PCAPNG file via tshark (optional dependency - install Wireshark). Extracts decoded fields Scapy's thin dissectors miss: DNS query/answer names, HTTP requests, TLS SNI hostnames (catches encrypted phone-home domains). Use limit to bound output.

  • analyze_pcap: Parse a PCAP/PCAPNG capture file and summarize network flows.

Hardware-protocol reverse engineering (pure Python, no tshark needed; for working out what bytes a host sends a device such as a label printer):

  • usb_list_hubs: List USB root hubs USBPcap can capture on (needs USBPcap installed; UNVERIFIED live).

  • usb_capture: Capture USB traffic with USBPcapCMD for 'timeout' seconds into save_path (needs USBPcap and administrator rights; UNVERIFIED live). Print/operate the device during the window.

  • usb_payloads: From a USBPcap capture, the data of each transfer (default host-to-device bulk/interrupt), per-endpoint totals, and any device/interface descriptors in the capture (answers "printer class, HID, or vendor-specific?"). export_path writes the concatenated stream to a .bin file.

  • btsnoop_payloads: From a Bluetooth HCI capture (btsnoop, or pcap/pcapng link type 187/201), the RFCOMM serial-port-profile data. Best effort: capture from before the connection is made.

  • diff_captures: Compare two captures' host-to-device streams (file_path vs file_path_b): shared prefix and suffix, changed byte ranges, per-transfer differences. For controlled experiments (blank label vs one dot).

Return Format

{"success": bool, "operation": str, "data": dict | list}

Examples

await packetsniffer_ops(operation="list_interfaces") await packetsniffer_ops(operation="sniff", interface="WiFi", count=10) await packetsniffer_ops(operation="sniff", filter_expr="udp port 53", count=200, timeout=120, save_path="C:/captures/dns.pcap") await packetsniffer_ops(operation="start_capture", filter_expr="udp port 53", count=1000, timeout=300) await packetsniffer_ops(operation="capture_status", capture_id="a1b2c3d4") await packetsniffer_ops(operation="stop_capture", capture_id="a1b2c3d4", save_path="C:/captures/dns.pcap") await packetsniffer_ops(operation="decode_pcap", file_path="C:/captures/dns.pcap", limit=100) await packetsniffer_ops(operation="analyze_pcap", file_path="C:/captures/dns.pcap") await packetsniffer_ops(operation="usb_list_hubs") await packetsniffer_ops(operation="usb_capture", usb_hub="\.\USBPcap1", timeout=30, save_path="C:/captures/02-dot.pcap") await packetsniffer_ops(operation="usb_payloads", file_path="C:/captures/02-dot.pcap", export_path="C:/captures/02-dot.bin") await packetsniffer_ops(operation="btsnoop_payloads", file_path="C:/captures/btsnoop_hci.log", direction="tx") await packetsniffer_ops(operation="diff_captures", file_path="C:/captures/01-blank.pcap", file_path_b="C:/captures/02-dot.pcap")

ParametersJSON Schema
NameRequiredDescriptionDefault
countNoNumber of packets to capture (default: 50, max: 500).
limitNoMax packets/transfers returned by 'decode_pcap', 'usb_payloads' and 'btsnoop_payloads' (default: 100, max: 500).
timeoutNoTimeout in seconds for capture (default: 10, max: 60).
usb_hubNoUSBPcap filter device for 'usb_capture', e.g. '\\.\USBPcap1' (see 'usb_list_hubs').
directionNoWhich way the bytes travelled. USB: 'out' (host to device, default), 'in', 'both'. Bluetooth: 'tx' (host to device, default), 'rx', 'both'. 'diff_captures' accepts either spelling.out
file_pathNoAbsolute path to the PCAP file for 'analyze_pcap' operation.
interfaceNoNetwork interface identifier (name or GUID) for sniffing.
max_bytesNoBytes of hex shown per transfer in 'usb_payloads' / 'btsnoop_payloads' (default: 256, max: 4096).
operationYesOperation to perform.
save_pathNoAbsolute path to write captured packets as a PCAP file (e.g. 'C:/captures/out.pcap'). Used by 'sniff' and 'stop_capture'.
capture_idNoCapture ID from 'start_capture'. Required for 'capture_status' and 'stop_capture'.
usb_deviceNoUSB device address to select in 'usb_payloads' / 'diff_captures' (default: all devices).
export_pathNoWrite the selected byte stream to this file (.bin/.dat/.raw) for 'usb_payloads' / 'btsnoop_payloads'.
file_path_bNoSecond capture file for 'diff_captures' (file_path is the first).
filter_exprNoBPF filter expression (e.g. 'tcp port 80', 'udp', 'host 192.168.1.100').
usb_devicesNo'usb_capture' only: comma list of device addresses to capture (default: all devices on the hub).
usb_endpointNoUSB endpoint number to select in 'usb_payloads' / 'diff_captures' (e.g. 2 for endpoint 0x02).
transfer_typesNoComma list of USB transfer types for 'usb_payloads': bulk, interrupt, control, isochronous (default: bulk,interrupt).
inject_descriptorsNo'usb_capture': ask USBPcap to inject descriptors of already-connected devices (default: false).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are minimal (readOnlyHint=false, destructiveHint=false), and the description carries the burden well beyond them: captures require administrator privileges, start_capture is non-blocking and survives across HTTP daemon sessions, stop_capture only takes effect on the next packet, save_path persists evidence, and dependencies (tshark, USBPcap) are flagged with live-verification caveats. This is exactly the operational context an agent needs before invoking a stateful capture tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

For a 12-operation, 19-parameter mega-tool the length is largely justified, and the operation-by-operation bullet structure is easy to scan and front-loads the domain statement. Minor waste comes from the '[RATIONALE]' self-justification about tool limits and the somewhat redundant example block, but nothing seriously hinders comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity, the description covers prerequisites, blocking semantics, background lifecycle, dependency caveats, and the return envelope ({success, operation, data}), and an output schema exists so return values need no further explanation. Nothing an agent needs to invoke these operations correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter is documented per-operation in the schema, so the baseline is 3. The description repeats most of that (save_path use, limit bounding, direction semantics) rather than adding genuinely new per-parameter meaning, so it does not rise above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The header names the domain (interface discovery, live capture, PCAP analysis) and each of the 12 operations is enumerated with a specific verb+resource, including the distinct USB/Bluetooth hardware-reverse-engineering group. An agent can tell exactly what any given operation does without opening the schema, and the scope is clearly distinct from siblings like workflow/help/status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Routing guidance is embedded throughout: sniff vs start_capture (blocking vs non-blocking background), decode_pcap vs analyze_pcap (deep tshark decode vs flow summary), and diff_captures 'for controlled experiments (blank label vs one dot)'. Prerequisites are also given (admin rights, tshark optional, USBPcap). What is missing is any explicit 'when not to use' or note on which operation to prefer when an agent is unsure.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

statusB

Server health and version.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does disclose the reported content (health and version). However, it says nothing about whether the call is read-only, whether it requires auth, or whether it can fail or be rate-limited. For a trivial zero-parameter endpoint the risk is low, so a middling score is fair rather than a penalty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four words, no filler, front-loaded on the resource. It is arguably terse to the point of under-specification, but nothing in it is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and with zero parameters there is little schema burden. What is missing is the usage context relative to the closely named sibling status_card and help, which leaves the definition merely adequate for a diagnostic endpoint.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a parameterless tool is 4. Schema coverage is 100% and the empty object schema is self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The fragment 'Server health and version' names the resource and the two things it reports, but there is no verb and no differentiation from the sibling 'packetsniffer_mcp_status_card', which an agent could easily confuse with this tool. Purpose is inferable but not stated with enough precision to route confidently.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no mention of prerequisites, and no reference to alternatives such as help or packetsniffer_mcp_status_card. The agent must guess the context in which this endpoint is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedagentic_packetsniffer_mcp_workflow
    • First observedchat
    • First observedhelp
    • First observedpacketsniffer_mcp_status_card
    • First observedpacketsniffer_ops
    • First observedstatus

TDQS

B3.1/5.0

Scored across 6 tools

Disambiguation3/5

Most tools target distinct concerns, but 'status' and 'packetsniffer_mcp_status_card' both expose server health (differing only in output format), and 'agentic_packetsniffer_mcp_workflow' has a vague, undefined purpose that overlaps conceptually with both chat and ops orchestration. An agent can mostly tell them apart, but the redundancy and the fuzzy workflow tool create real selection risk.

Naming Consistency3/5

All names are snake_case, but prefixing is inconsistent: three tools carry a 'packetsniffer'/'agentic_packetsniffer_mcp' namespace prefix while 'help', 'status', and 'chat' are bare, and the naming mixes workflow-style, health-style, and action-style conventions. Readable but not a predictable pattern.

Tool Count4/5

Six top-level tools is a reasonable, well-scoped surface for this server. However, 'packetsniffer_ops' is an over-consolidated mega-tool packing roughly 14 distinct operations, which pushes complexity into a single tool rather than the count itself.

Completeness4/5

The ops tool covers the sniffing lifecycle well: interface discovery, blocking/background capture, capture status, stop, PCAP decode and analysis, plus USB and Bluetooth payload extraction and diffing. Minor gaps remain (no live stream display, packet injection, or filter validation), but core workflows are covered.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides AI assistants with direct access to Wireshark network analysis capabilities, enabling AI-powered network troubleshooting, packet analysis, and network monitoring through a secure interface.
    13
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to analyze network traffic using Wireshark/tshark, providing packet statistics, protocol analysis, and anomaly detection through natural language interaction.
    68
    MIT
  • F
    license
    C
    quality
    D
    maintenance
    Enables LLMs to capture, analyze, and summarize network traffic using Wireshark CLI tools, supporting live capture, pcap analysis, and LLM-oriented summaries.
    76
    -