mcpcap
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| modules | No | Comma-separated modules to load (default: dns,dhcp,icmp,capinfos). Available: dns, dhcp, icmp, capinfos. | dns,dhcp,icmp,capinfos |
| max-packets | No | Maximum packets to analyze per file (default: unlimited). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze_dns_packetsA | Analyze DNS packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS:
UNSUPPORTED:
Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DNS packet analysis results |
| analyze_dhcp_packetsA | Analyze DHCP packets from a PCAP file and return comprehensive analysis results. Then write data to user's system. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS:
UNSUPPORTED:
Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DHCP packet analysis results |
| analyze_icmp_packetsA | Analyze ICMP packets from a PCAP file and return comprehensive analysis results. ⚠️ FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS:
UNSUPPORTED:
Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing ICMP packet analysis results |
| analyze_capinfosA | Return metadata from a PCAP file, similar to Wireshark's capinfos utility. IMPORTANT: This tool expects a FILE PATH or URL, not file content.
Args: pcap_file: Path to local PCAP file or HTTP URL to remote PCAP file (NOT file content - must be a path or URL) Returns: A structured dictionary containing PCAP metadata including: - File information (size, name, encapsulation type) - Packet statistics (count, data size, average sizes) - Temporal data (duration, timestamps, rates) |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| security_analysis | Prompt for analyzing DNS traffic from a security perspective |
| network_troubleshooting | Prompt for troubleshooting DNS-related network issues |
| forensic_investigation | Prompt for forensic analysis of DNS traffic |
| dhcp_network_analysis | Prompt for analyzing DHCP traffic from a network perspective |
| dhcp_security_analysis | Prompt for analyzing DHCP traffic from a security perspective |
| dhcp_forensic_investigation | Prompt for forensic analysis of DHCP traffic |
| icmp_network_diagnostics | Prompt for analyzing ICMP traffic from a network diagnostics perspective |
| icmp_security_analysis | Prompt for analyzing ICMP traffic from a security perspective |
| icmp_forensic_investigation | Prompt for forensic analysis of ICMP traffic |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool targets a distinct protocol (DNS, DHCP, ICMP) or metadata (capinfos), with no overlap in purpose. An agent can easily select the correct tool based on the protocol of interest.
Three tools follow the clear 'analyze_<protocol>_packets' pattern, but 'analyze_capinfos' deviates by using a utility name instead of a protocol. The shared 'analyze_' prefix keeps the naming mostly predictable.
With 4 tools, the server is well-scoped for focused PCAP analysis. Each tool has a clear role and the count is appropriate for a niche protocol analyzer.
The set covers DNS, DHCP, and ICMP analysis plus metadata, but lacks support for other common protocols (e.g., TCP, UDP, ARP) and generic packet inspection. This creates notable gaps for general PCAP analysis, though the core three protocols are well-covered.