packetsniffer-mcp
Provides tools to analyze Bluetooth HCI/btsnoop captures, extracting RFCOMM serial port profile payloads, frame types, lengths, and checksums.
Supports Google's LLM API as a cloud provider for chat and agentic workflows, configured via GOOGLE_API_KEY.
Integrates with a local Ollama server for LLM-powered chat and agentic workflows, auto-detected on port 11434.
Integrates with OpenAI's LLM API as a cloud provider for chat and agentic workflows, configured via OPENAI_API_KEY.
Uses Wireshark's tshark dissectors to deeply decode PCAP/PCAPNG files, extracting DNS answers, HTTP requests, TLS SNI hostnames, USBPcap, and RFCOMM fields.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@packetsniffer-mcpwhat's in this capture file? C:/captures/router.pcap"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
packetsniffer-mcp
MCP server for local network packet capture and PCAP file analysis.
Stack: Python 3.12+ · FastMCP 3.4 · FastAPI · prefab-ui · Multi-provider LLM · Sampling · CodeMode (--agentic)
What can I do with this?
A network debugger you can ask questions of. The agent drives Scapy via one
portmanteau tool (packetsniffer_ops) instead of you wrangling Wireshark/tshark:
Scenario | Call |
"What is in this capture file?" — analyze any |
|
"What is phoning home?" — watch DNS queries to find which app contacts which domain. Pass |
|
"Watch it in the background" — start a capture, don't block the agent. Poll, then collect. Survives across agent sessions in HTTP daemon mode. |
|
"Decode it deeply" — after a capture, extract decoded fields Scapy misses: full DNS answers, HTTP requests, and TLS SNI hostnames (catches encrypted phone-home domains). Requires tshark (ships with Wireshark). |
|
"Why is my service unreachable?" — capture traffic to one port and see whether packets arrive at all, and how the TCP handshake behaves. |
|
"What is on my network?" — list interfaces before capturing. |
|
"What bytes does this app send my USB device?" — pull the host-to-device data out of a USBPcap capture, with per-endpoint totals and any captured device/interface descriptors (printer class? HID? vendor-specific?). Pure Python, no tshark. |
|
"What does it send over Bluetooth serial?" — RFCOMM (serial port profile) data from a Bluetooth HCI capture (btsnoop log from an Android phone, or Wireshark pcap/pcapng). |
|
"Which bytes encode the dot?" — diff two captures (blank label vs one-dot label): shared prefix/suffix, changed byte ranges, per-transfer differences. |
|
"Capture USB while I operate the device" — wraps USBPcap's command line for a fixed duration. Unverified live (needs the USBPcap driver, administrator rights). |
|
Results come back as structured JSON (flows, protocol mix, per-packet summaries) so the agent can interpret them directly — no pcap GUI needed.
Hardware reverse engineering (USB / Bluetooth):
usb_payloads,btsnoop_payloadsanddiff_captureswork on files anywhere, with no privileges and no tshark. They are tested against synthetic captures, and when tshark is installed a test cross-checks the same files against Wireshark's own dissectors (USBPcap bus/device/endpoint/transfer type/payload, RFCOMM frame types, lengths and check bytes; verified with Wireshark 4.6.8). Not yet tested against a capture from real hardware.usb_capture/usb_list_hubsdriveUSBPcapCMD.exe(winget install desowin.USBPcap; a capture driver, administrator rights, and a reboot before the driver attaches to the USB hubs). The flags used (-d,-o,-A,--devices,--inject-descriptors) match the real tool's--help(USBPcap 1.5.4.0). Orchestration is tested through a fake executable; a live capture has not been run yet.Bluetooth: the capture must start before the device connects, or the L2CAP channel table is missing and only frames whose checksum verifies are kept. Classic Bluetooth cannot be sniffed from Windows; use an Android phone's HCI snoop log. Credit-based flow control bytes are handled; unusual RFCOMM streams may not decode.
Method and capture protocol: see the DYMO MobileLabeler plan in devices-mcp,
docs/LABEL_PRINTER_REVERSE_ENGINEERING.md.
Limits / requirements:
analyze_pcapanddecode_pcapwork on files anywhere, no privileges.decode_pcapneeds tshark on PATH (ships with Wireshark —winget install Wireshark). Without it, the op returns a cleanmissing_dependencyerror, nothing else breaks.Live
sniff/start_capturerequire administrator privileges, and on Windows the Npcap driver (Wireshark's capture backend).Loopback capture (
127.0.0.1) is unreliable on Windows — this tool shines on WiFi/LAN/DNS traffic and offline capture files, not localhost webapp debugging.Capture defaults are bounded:
countmax 1000,timeoutmax 300s. Raise the ceilings viaPACKETSNIFFER_MCP_MAX_SNIFF_COUNT/PACKETSNIFFER_MCP_MAX_SNIFF_SECONDSfor long-running captures.Background captures live in the server process: run the HTTP daemon (
start.ps1/--http) for captures that outlive a single agent session.stop_capturetakes effect on the next packet — with no traffic on the interface it finishes at the timeout.
Related MCP server: mcp-wireshark
Install
uv sync --extra dev
pre-commit installRun
# stdio (Claude Desktop / Cursor)
uv run python -m packetsniffer_mcp
# HTTP + REST API (direct access)
uv run python -m packetsniffer_mcp --http --port 10920
# CodeMode agentic discovery
uv run python -m packetsniffer_mcp --agentic
# Dev launcher (auto-opens browser; `-Headless` to skip)
.\start.ps1LLM Providers
Auto-detects local providers (Ollama on :11434, LM Studio on :1234). Configure via environment variables:
Variable | Purpose |
| ollama | lmstudio | openai | anthropic | google |
| Override model name |
| API key (cloud providers) |
Cloud providers detect their standard env vars: OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY.
API Endpoints (HTTP mode)
Method | Path | Description |
GET |
| Health check |
GET |
| Full diagnostics (LLM, tools, system) |
GET |
| List all MCP tools |
GET |
| List LLM providers + presets |
POST |
| Chat with LLM (supports streaming) |
Fleet Surface
Feature | Entry |
Help |
|
Status |
|
Prefab card |
|
Chat |
|
Agentic |
|
Skills |
|
Capabilities |
|
CodeMode |
|
License
MIT © 2026 MCP Studio
Available Tools
6 toolsagentic_packetsniffer_mcp_workflowC
Run a multi-step workflow using FastMCP sampling when the client supports it.
| Name | Required | Description | Default |
|---|---|---|---|
| max_iterations | No | ||
| available_tools | No | ||
| workflow_prompt | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden. It hints at FastMCP sampling and a fallback condition but omits crucial traits: whether the workflow mutates state, how iterations are bounded, permission/auth requirements, cost/latency implications, and what 'sampling' means operationally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the key capability front-loaded. It is efficient, though almost too terse for a multi-step process. Given the complexity of the operation, the brevity edges into under-specification rather than pure conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values need not be explained. However, for a complex multi-step, tool-using workflow with three undocumented parameters, no annotations, and no usage routing against five siblings, the description is far too thin to tell an agent how to invoke it correctly or safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for all three parameters. The description mentions no parameter behavior: it does not explain that workflow_prompt drives the sampling, that max_iterations bounds the loop, or what available_tools filters. With three undocumented params, the description fails to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a verb and resource ('Run a multi-step workflow'), which is clearer than a tautology, but 'workflow' is generic and the description gives no sense of what the workflow actually does or how it differs from sibling tool 'chat' or 'packetsniffer_ops'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only conditional is 'when the client supports it,' which is about capability, not task fit. There is no guidance on when to choose this over 'chat' or 'packetsniffer_ops', and no explanation of what happens when the client does not support FastMCP sampling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chatARead-only
Chat with the configured LLM provider (local or cloud).
Uses the unified LLM client which auto-detects local providers (Ollama, LM Studio) and supports cloud providers (OpenAI, Anthropic, Google Gemini) via API keys.
The provider and model can be overridden per-request.
Return Format
{"success": bool, "content": str, "model": str, "provider": str}
Examples
await chat(prompt="What is the capital of Austria?") await chat(prompt="Explain quantum computing in 3 sentences", system="Be concise.") await chat(prompt="Hello", provider="openai", model="gpt-4o") await chat(prompt="Describe Vienna", temperature=0.3)
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Override model name. | |
| prompt | Yes | The message or question to send to the LLM. | |
| system | No | Optional system prompt to set context. | |
| provider | No | Override provider: ollama, lmstudio, openai, anthropic, google. | |
| max_tokens | No | Max tokens in response. | |
| temperature | No | Sampling temperature 0.0-2.0. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds genuinely useful behavior beyond that: provider auto-detection order for local runtimes, the API-key requirement for cloud providers, and per-request override semantics. It stops short of noting cost, latency, or rate-limit implications of cloud calls.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first sentence, with provider mechanics second and examples last. The 'Return Format' block partially duplicates the output schema and is the one section that does not fully earn its place, but the examples themselves are compact and instructive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, explaining return values is optional and the restated format is a minor redundancy rather than a gap. The description covers provider resolution, overrides, and parameter usage sufficiently; only failure modes (no provider configured, invalid API key, provider unreachable) are left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the examples meaningfully add value by showing how parameters compose (system prompt alongside prompt, provider+model override together, temperature tuning). That demonstrates the override precedence described in prose but not spelled out per-parameter in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (send a prompt to the configured LLM) and resource, then explains the underlying mechanism: a unified client that auto-detects local providers (Ollama, LM Studio) and supports cloud providers via API keys. Sibling tools (status, help, ops, workflow) are unrelated utility endpoints, so no sibling differentiation is required for an agent to pick correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is demonstrated through four concrete examples rather than stated explicitly; there is no 'use this when...' guidance or exclusion of alternatives. The mention of API keys for cloud providers is the only implicit prerequisite, and nothing tells the agent what happens when no provider is reachable. Adequate but with clear gaps for a tool whose behavior varies by environment.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
helpB
List capabilities and fleet surface for PacketsnifferMcp.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full behavioral burden. 'List' weakly implies a read-only operation, but there is no explicit statement about safety, side effects, authentication, or rate limits. The output schema covers return values, but behavioral traits are not disclosed beyond the verb.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loading the action and resource. It is appropriately sized for a zero-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (zero params) and has an output schema, so return details are not needed. However, the description never explains what 'fleet surface' means or how this tool relates to sibling status and status_card tools, leaving a clear contextual gap for an agent deciding when to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and schema coverage is 100%, so the rubric sets a baseline of 4. There are no parameters for the description to clarify, and the schema is trivially complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
State a specific verb 'List' and resource 'capabilities and fleet surface for PacketsnifferMcp', so an agent can tell it is a discovery/help tool. However, 'fleet surface' is undefined jargon and the description does not distinguish it from sibling tools like status or packetsniffer_mcp_status_card.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or alternative tool guidance is provided. The name 'help' hints at discovery, but the description itself gives no explicit context for selecting this tool over status, packetsniffer_mcp_status_card, or others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
packetsniffer_mcp_status_cardBRead-only
Server health as a Prefab card.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful output-format context ('Prefab card') but does not describe authentication, rate limits, or other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is slightly terse and lacks an explicit verb, but the structure is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only status tool with no output schema, the description provides enough context: it returns server health formatted as a Prefab card. Additional detail about card contents or call frequency could improve it, but the essentials are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics to explain. The baseline for a zero-parameter tool is 4, and the description does not need to compensate for any schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the resource (server health) and output form (a Prefab card), which distinguishes it from the sibling 'status' tool. The verb is implicit rather than explicit, but an agent can infer it retrieves a status card.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as 'status' or 'help'. The agent must infer usage from the name and description alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
packetsniffer_opsA
Network interface discovery, live packet capture, and PCAP analysis.
[RATIONALE] Consolidates local packet sniffing, background captures, and offline PCAP analysis tools to stay under tool limits while providing full companion hacking capability.
Operations:
list_interfaces: List active network interfaces with details.
sniff: Blocking capture for the given count/timeout (requires admin privileges). Pass save_path to persist the capture to a PCAP file for later analysis or evidence.
start_capture: Start a capture in the background (non-blocking). Returns a capture_id immediately; the capture runs in a server thread until count/timeout is reached or stop_capture is called. In HTTP daemon mode the capture survives across agent sessions. Poll with capture_status.
capture_status: Status of one capture (capture_id) or all active captures.
stop_capture: Request a stop (takes effect on the next packet, or at timeout). Returns packets captured so far; pass save_path to persist them.
decode_pcap: Deep protocol decode of a PCAP/PCAPNG file via tshark (optional dependency - install Wireshark). Extracts decoded fields Scapy's thin dissectors miss: DNS query/answer names, HTTP requests, TLS SNI hostnames (catches encrypted phone-home domains). Use limit to bound output.
analyze_pcap: Parse a PCAP/PCAPNG capture file and summarize network flows.
Hardware-protocol reverse engineering (pure Python, no tshark needed; for working out what bytes a host sends a device such as a label printer):
usb_list_hubs: List USB root hubs USBPcap can capture on (needs USBPcap installed; UNVERIFIED live).
usb_capture: Capture USB traffic with USBPcapCMD for 'timeout' seconds into save_path (needs USBPcap and administrator rights; UNVERIFIED live). Print/operate the device during the window.
usb_payloads: From a USBPcap capture, the data of each transfer (default host-to-device bulk/interrupt), per-endpoint totals, and any device/interface descriptors in the capture (answers "printer class, HID, or vendor-specific?"). export_path writes the concatenated stream to a .bin file.
btsnoop_payloads: From a Bluetooth HCI capture (btsnoop, or pcap/pcapng link type 187/201), the RFCOMM serial-port-profile data. Best effort: capture from before the connection is made.
diff_captures: Compare two captures' host-to-device streams (file_path vs file_path_b): shared prefix and suffix, changed byte ranges, per-transfer differences. For controlled experiments (blank label vs one dot).
Return Format
{"success": bool, "operation": str, "data": dict | list}
Examples
await packetsniffer_ops(operation="list_interfaces") await packetsniffer_ops(operation="sniff", interface="WiFi", count=10) await packetsniffer_ops(operation="sniff", filter_expr="udp port 53", count=200, timeout=120, save_path="C:/captures/dns.pcap") await packetsniffer_ops(operation="start_capture", filter_expr="udp port 53", count=1000, timeout=300) await packetsniffer_ops(operation="capture_status", capture_id="a1b2c3d4") await packetsniffer_ops(operation="stop_capture", capture_id="a1b2c3d4", save_path="C:/captures/dns.pcap") await packetsniffer_ops(operation="decode_pcap", file_path="C:/captures/dns.pcap", limit=100) await packetsniffer_ops(operation="analyze_pcap", file_path="C:/captures/dns.pcap") await packetsniffer_ops(operation="usb_list_hubs") await packetsniffer_ops(operation="usb_capture", usb_hub="\.\USBPcap1", timeout=30, save_path="C:/captures/02-dot.pcap") await packetsniffer_ops(operation="usb_payloads", file_path="C:/captures/02-dot.pcap", export_path="C:/captures/02-dot.bin") await packetsniffer_ops(operation="btsnoop_payloads", file_path="C:/captures/btsnoop_hci.log", direction="tx") await packetsniffer_ops(operation="diff_captures", file_path="C:/captures/01-blank.pcap", file_path_b="C:/captures/02-dot.pcap")
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Number of packets to capture (default: 50, max: 500). | |
| limit | No | Max packets/transfers returned by 'decode_pcap', 'usb_payloads' and 'btsnoop_payloads' (default: 100, max: 500). | |
| timeout | No | Timeout in seconds for capture (default: 10, max: 60). | |
| usb_hub | No | USBPcap filter device for 'usb_capture', e.g. '\\.\USBPcap1' (see 'usb_list_hubs'). | |
| direction | No | Which way the bytes travelled. USB: 'out' (host to device, default), 'in', 'both'. Bluetooth: 'tx' (host to device, default), 'rx', 'both'. 'diff_captures' accepts either spelling. | out |
| file_path | No | Absolute path to the PCAP file for 'analyze_pcap' operation. | |
| interface | No | Network interface identifier (name or GUID) for sniffing. | |
| max_bytes | No | Bytes of hex shown per transfer in 'usb_payloads' / 'btsnoop_payloads' (default: 256, max: 4096). | |
| operation | Yes | Operation to perform. | |
| save_path | No | Absolute path to write captured packets as a PCAP file (e.g. 'C:/captures/out.pcap'). Used by 'sniff' and 'stop_capture'. | |
| capture_id | No | Capture ID from 'start_capture'. Required for 'capture_status' and 'stop_capture'. | |
| usb_device | No | USB device address to select in 'usb_payloads' / 'diff_captures' (default: all devices). | |
| export_path | No | Write the selected byte stream to this file (.bin/.dat/.raw) for 'usb_payloads' / 'btsnoop_payloads'. | |
| file_path_b | No | Second capture file for 'diff_captures' (file_path is the first). | |
| filter_expr | No | BPF filter expression (e.g. 'tcp port 80', 'udp', 'host 192.168.1.100'). | |
| usb_devices | No | 'usb_capture' only: comma list of device addresses to capture (default: all devices on the hub). | |
| usb_endpoint | No | USB endpoint number to select in 'usb_payloads' / 'diff_captures' (e.g. 2 for endpoint 0x02). | |
| transfer_types | No | Comma list of USB transfer types for 'usb_payloads': bulk, interrupt, control, isochronous (default: bulk,interrupt). | |
| inject_descriptors | No | 'usb_capture': ask USBPcap to inject descriptors of already-connected devices (default: false). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are minimal (readOnlyHint=false, destructiveHint=false), and the description carries the burden well beyond them: captures require administrator privileges, start_capture is non-blocking and survives across HTTP daemon sessions, stop_capture only takes effect on the next packet, save_path persists evidence, and dependencies (tshark, USBPcap) are flagged with live-verification caveats. This is exactly the operational context an agent needs before invoking a stateful capture tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
For a 12-operation, 19-parameter mega-tool the length is largely justified, and the operation-by-operation bullet structure is easy to scan and front-loads the domain statement. Minor waste comes from the '[RATIONALE]' self-justification about tool limits and the somewhat redundant example block, but nothing seriously hinders comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity, the description covers prerequisites, blocking semantics, background lifecycle, dependency caveats, and the return envelope ({success, operation, data}), and an output schema exists so return values need no further explanation. Nothing an agent needs to invoke these operations correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter is documented per-operation in the schema, so the baseline is 3. The description repeats most of that (save_path use, limit bounding, direction semantics) rather than adding genuinely new per-parameter meaning, so it does not rise above the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The header names the domain (interface discovery, live capture, PCAP analysis) and each of the 12 operations is enumerated with a specific verb+resource, including the distinct USB/Bluetooth hardware-reverse-engineering group. An agent can tell exactly what any given operation does without opening the schema, and the scope is clearly distinct from siblings like workflow/help/status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Routing guidance is embedded throughout: sniff vs start_capture (blocking vs non-blocking background), decode_pcap vs analyze_pcap (deep tshark decode vs flow summary), and diff_captures 'for controlled experiments (blank label vs one dot)'. Prerequisites are also given (admin rights, tshark optional, USBPcap). What is missing is any explicit 'when not to use' or note on which operation to prefer when an agent is unsure.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
statusB
Server health and version.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does disclose the reported content (health and version). However, it says nothing about whether the call is read-only, whether it requires auth, or whether it can fail or be rate-limited. For a trivial zero-parameter endpoint the risk is low, so a middling score is fair rather than a penalty.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four words, no filler, front-loaded on the resource. It is arguably terse to the point of under-specification, but nothing in it is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and with zero parameters there is little schema burden. What is missing is the usage context relative to the closely named sibling status_card and help, which leaves the definition merely adequate for a diagnostic endpoint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a parameterless tool is 4. Schema coverage is 100% and the empty object schema is self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The fragment 'Server health and version' names the resource and the two things it reports, but there is no verb and no differentiation from the sibling 'packetsniffer_mcp_status_card', which an agent could easily confuse with this tool. Purpose is inferable but not stated with enough precision to route confidently.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no mention of prerequisites, and no reference to alternatives such as help or packetsniffer_mcp_status_card. The agent must guess the context in which this endpoint is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
agentic_packetsniffer_mcp_workflow - First observed
chat - First observed
help - First observed
packetsniffer_mcp_status_card - First observed
packetsniffer_ops - First observed
status
TDQS
Scored across 6 tools
Most tools target distinct concerns, but 'status' and 'packetsniffer_mcp_status_card' both expose server health (differing only in output format), and 'agentic_packetsniffer_mcp_workflow' has a vague, undefined purpose that overlaps conceptually with both chat and ops orchestration. An agent can mostly tell them apart, but the redundancy and the fuzzy workflow tool create real selection risk.
All names are snake_case, but prefixing is inconsistent: three tools carry a 'packetsniffer'/'agentic_packetsniffer_mcp' namespace prefix while 'help', 'status', and 'chat' are bare, and the naming mixes workflow-style, health-style, and action-style conventions. Readable but not a predictable pattern.
Six top-level tools is a reasonable, well-scoped surface for this server. However, 'packetsniffer_ops' is an over-consolidated mega-tool packing roughly 14 distinct operations, which pushes complexity into a single tool rather than the count itself.
The ops tool covers the sniffing lifecycle well: interface discovery, blocking/background capture, capture status, stop, PCAP decode and analysis, plus USB and Bluetooth payload extraction and diffing. Minor gaps remain (no live stream display, packet injection, or filter validation), but core workflows are covered.
Maintenance
Related MCP Connectors
Live browser debugging for AI assistants — DOM, console, network via MCP.
SEO & marketing toolkit for AI agents: GA4, Search Console, AdSense, GTM, PageSpeed, Trends.
Capture, inspect & debug HTTPS traffic across iOS, Android, browsers & backends — 304 MCP tools.
Anonymous webhook capture, inspection, waiting, and response configuration for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides AI assistants with direct access to Wireshark network analysis capabilities, enabling AI-powered network troubleshooting, packet analysis, and network monitoring through a secure interface.13MIT
- AlicenseAqualityAmaintenanceEnables AI assistants to analyze, filter, and capture network traffic using Wireshark/tshark, allowing natural language interaction with packet captures.14121 PyPI61MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to analyze network traffic using Wireshark/tshark, providing packet statistics, protocol analysis, and anomaly detection through natural language interaction.68MIT
- FlicenseCqualityDmaintenanceEnables LLMs to capture, analyze, and summarize network traffic using Wireshark CLI tools, supporting live capture, pcap analysis, and LLM-oriented summaries.76-