Wireshark MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| WIRESHARK_PCAP_DIR | No | Directory on remote host for pcap files | /tmp/mcp-pcaps |
| WIRESHARK_SSH_HOST | No | SSH hostname or IP of the remote machine | kali |
| WIRESHARK_SSH_USER | No | SSH username (optional if using SSH config) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| tshark_list_interfacesA | List available network interfaces on the remote Kali machine for packet capture |
| tshark_captureB | Start packet capture on the remote Kali machine. Returns captured packets in JSON format. Requires sudo on the remote host. |
| tshark_read_pcapB | Read and analyze a pcap file from the remote Kali machine. Returns packets in JSON format. |
| tshark_filterC | Apply a display filter to a pcap file and return matching packets. Useful for extracting specific traffic. |
| tshark_statsC | Get protocol statistics from a pcap file. Shows protocol hierarchy, conversations, and endpoints. |
| tshark_follow_streamA | Follow and reconstruct a TCP, UDP, or HTTP stream from a pcap file. Shows the full conversation. |
| tshark_extract_filesC | Extract files from HTTP, DICOM, IMF, SMB, or TFTP traffic in a pcap file. |
| tshark_decodeC | Decode specific packets with detailed protocol information. Useful for deep packet inspection. |
| tshark_extract_credentialsB | Search for potential credentials in network traffic (HTTP Basic Auth, FTP, Telnet, etc.) |
| tshark_export_objectsB | List and export HTTP objects (files) from a pcap capture |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Each tool has a clearly distinct purpose, covering different aspects of packet analysis: capture, read, filter, decode, export objects, extract credentials, follow streams, list interfaces, and statistics. No overlap in functionality.
All tools follow a consistent 'tshark_' prefix with lowercase and underscores. Verbs are well-chosen and predictable (e.g., capture, decode, filter, follow_stream), making the surface easy to navigate.
With 10 tools, the server is well-scoped for the domain of network packet analysis. It provides a focused set without being overwhelming or too sparse.
The tool set covers key workflows: capture, read, filter, decode, extract objects/credentials, and statistics. Minor gaps exist (e.g., no tool to stop capture or merge pcaps), but the core functionality is well-represented.