Enables packet capture and analysis through Wireshark/tshark integration, allowing the agent to start recording network traffic, analyze packet contents, apply filters, decrypt SSL/TLS traffic, and troubleshoot network issues
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SharkMCP capture HTTPS traffic on port 443 for 30 seconds and show me the results"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that provides network packet capture and analysis capabilities through Wireshark/tshark integration. Designed for AI assistants to perform network security analysis, troubleshooting, and packet inspection.
This server was thought for situations where you want your agent to debug a program that sends requests and verify the packet traffic, allowing the following workflow:
Start recording packets
Run tool or perform request
Stop recording and analyze results
SharkMCP provides a simple, local development-focused architecture:
┌─────────────────────────────────────────────────────────┐
│ SharkMCP Server │
├─────────────────────────────────────────────────────────┤
│ MCP Protocol Layer │
│ ├─ start_capture_session │
│ ├─ stop_capture_session │
│ ├─ analyze_pcap_file │
│ └─ manage_config │
├─────────────────────────────────────────────────────────┤
│ tshark Integration Layer │
│ ├─ Cross-platform executable detection │
│ ├─ Process management │
│ └─ Output parsing (JSON/fields/text) │
├─────────────────────────────────────────────────────────┤
│ Host System Integration │
│ ├─ Local tshark installation │
│ ├─ Direct network interface access │
│ └─ Native file system operations │
└─────────────────────────────────────────────────────────┘Related MCP server: Wireshark MCP
Async Packet Capture: Start background capture sessions with configurable filters and timeouts.
PCAP File Analysis: Analyze existing packet capture files
Flexible Output Formats: JSON, custom fields, or traditional text output
SSL/TLS Decryption: Support for SSL keylog files to decrypt HTTPS traffic
Reusable Configurations: Save and reuse capture/analysis configurations
/!\ Packet information can be very extensive. Make sure to use a scoped display filter not to overload the context of your conversation.
Wireshark/tshark: Must be installed and accessible
Node.js: Version 18+
pnpm: Package manager (recommended)
macOS (using Homebrew):
brew install wiresharkUbuntu/Debian:
sudo apt update
sudo apt install tshark wireshark-commonWindows: Download from wireshark.org
Clone the repository:
git clone https://github.com/kriztalz/SharkMCP.git
cd SharkMCPInstall dependencies:
pnpm installBuild the project:
pnpm run buildRun the server:
pnpm startSharkMCP includes comprehensive integration tests that verify packet capture functionality.
# Run all tests
pnpm test{
"mcpServers": {
"sharkmcp": {
"command": "node",
"args": ["/path/to/SharkMCP/dist/index.js"],
}
}
}To decrypt HTTPS traffic, export the SSLKEYLOGFILE environment variable:
export SSLKEYLOGFILE=/path/to/sslkeylog.logThen configure your applications to log SSL keys to this file. Many applications support this automatically when the environment variable is set.
Then pass the log file pathname to the MCP server in the stop_capture_session tool.
start_capture_session: Start background packet capture
stop_capture_session: Stop capture and analyze results
analyze_pcap_file: Analyze existing PCAP files
manage_config: Save/load reusable configurations
Start a capture session:
Interface: en0
Capture Filter: port 443
Timeout: 30 secondsAnalyze captured traffic:
Display Filter: tls.handshake.type == 1
Output Format: jsonSave a configuration:
{
"name": "https-monitoring",
"description": "Monitor HTTPS traffic",
"captureFilter": "port 443",
"displayFilter": "tls.handshake.type == 1",
"outputFormat": "json",
"timeout": 60,
"interface": "en0"
}SharkMCP/
├── src/
│ ├── index.ts # Main server setup
│ ├── types.ts # TypeScript interfaces
│ ├── utils.ts # Utility functions
│ └── tools/ # Individual tool implementations
│ ├── start-capture-session.ts
│ ├── stop-capture-session.ts
│ ├── analyze-pcap-file.ts
│ └── manage-config.ts
├── test/ # Test files
│ └── integration.test.js # Integration tests
├── package.json
└── README.md# Development mode with auto-reload
pnpm run dev
# Build for production
pnpm run build
# Run tests
pnpm run test
# Type checking
pnpm run buildNetwork Permissions: Packet capture requires elevated privileges
File Access: Temporary files are created in /tmp/
Docker Security: Container runs as non-root user
SSL Keylog: Sensitive SSL keys should be handled securely
"tshark not found":
Ensure Wireshark is installed and tshark is in PATH
Check installation with: tshark -v
Permission denied for packet capture:
On Linux: Add user to wireshark group or run with sudo
On macOS: Grant Terminal network access in System Preferences
On Windows: Run as Administrator
No packets captured:
Verify network interface name (ip link on Linux, ifconfig on macOS)
Check capture filter syntax
Ensure traffic is present on the interface
Fork the repository
Create a feature branch
Make your changes following the existing code style
Add tests for new functionality
Submit a pull request
MIT License
Feel free to open an issue with any question or suggestion you may have.
Analyze a local pcap/pcapng file. LLMs control all analysis parameters including filters, output formats, and custom fields. Can use saved configurations.
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Path to the local .pcap or .pcapng file to analyze. | |
| displayFilter | No | Wireshark display filter for analysis (e.g., "tls.handshake.type == 1") | |
| outputFormat | No | Output format: json (-T json), fields (custom -e), or text (default wireshark output) | text |
| customFields | No | Custom tshark field list (only used with outputFormat=fields) | |
| sslKeylogFile | No | ABSOLUTE path to SSL keylog file for TLS decryption | |
| configName | No | Name of saved configuration to use for analysis parameters |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that 'LLMs control all analysis parameters' and 'can use saved configurations', but fails to describe critical behaviors like whether this is a read-only analysis, what happens with invalid inputs, performance implications for large files, or error handling. This leaves significant gaps for a tool with 6 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two sentences that directly address the tool's functionality. It's front-loaded with the core purpose and efficiently mentions key capabilities without unnecessary elaboration, though it could be slightly more structured for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, no annotations, no output schema), the description is insufficient. It doesn't explain what the analysis returns, how results are structured, error conditions, or performance considerations. For a tool that analyzes network capture files—a potentially complex operation—this leaves too many contextual gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond the schema, mentioning 'filters, output formats, and custom fields' and 'saved configurations' which map to parameters but don't provide additional semantic context. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('analyze') and resource ('a local pcap/pcapng file'), making the purpose evident. However, it doesn't explicitly differentiate from sibling tools like 'start_capture_session' or 'manage_config', which would require a more specific comparison to achieve a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings (e.g., 'start_capture_session' for live capture vs. file analysis) or any prerequisites. It mentions 'saved configurations' but doesn't explain when they're appropriate, leaving usage context unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Save, load, list, or delete reusable filter configurations. Allows LLMs to store commonly used capture and analysis parameters for easy reuse.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform: save, load, list (brief), view (detailed), or delete a configuration | |
| name | No | Name of the configuration (required for save, load, delete) | |
| detailed | No | Show detailed configuration info when listing (only used with list action) | |
| config | No | Configuration object (required for save action) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. While it mentions the four operations, it doesn't describe what happens during each action (e.g., whether 'delete' is permanent, whether 'save' overwrites existing configs, error conditions, or persistence mechanisms). For a CRUD-style tool with multiple operations, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two sentences that efficiently state the tool's purpose and value proposition. It's front-loaded with the core operations and avoids unnecessary elaboration. Every sentence contributes meaning without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters (including a complex nested object), 100% schema coverage, and no output schema, the description provides adequate but minimal context. It covers the 'what' but lacks details about operational behavior, error handling, and integration with sibling tools. The absence of annotations increases the need for more comprehensive description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond what's in the schema - it mentions 'capture and analysis parameters' which aligns with the config object properties, but provides no additional semantic context about parameter relationships or usage patterns.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs (save, load, list, delete) and resource (reusable filter configurations). It distinguishes from sibling tools by focusing on configuration management rather than packet capture or analysis operations, making the scope immediately apparent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'allows LLMs to store commonly used capture and analysis parameters for easy reuse' which provides some context, but offers no explicit guidance on when to use this tool versus alternatives like manually configuring parameters each time. There's no mention of prerequisites, limitations, or comparison with sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Start a background packet capture session. LLMs control all capture parameters including filters, interfaces, and packet limits. Can use saved configurations.
| Name | Required | Description | Default |
|---|---|---|---|
| interface | No | Network interface to capture from (e.g., eth0, en0, lo0) | lo0 |
| captureFilter | No | Optional BPF capture filter to apply while capturing (e.g., "port 443") | |
| timeout | No | Timeout in seconds before auto-stopping capture (default: 60s to prevent orphaned sessions) | |
| maxPackets | No | Maximum number of packets to capture (safety limit, default: 100,000) | |
| sessionName | No | Optional session name for easier identification | |
| configName | No | Name of saved configuration to use (will override other parameters) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that this starts a 'background' session (implying asynchronous operation) and mentions 'safety limits' like packet maximums, but it doesn't cover critical behavioral aspects such as authentication requirements, rate limits, error conditions, or what happens to existing sessions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by supporting details. Both sentences earn their place by clarifying scope and capabilities without redundancy, making it efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (starting a background capture with 6 parameters) and no annotations or output schema, the description is moderately complete. It covers the purpose and key features but lacks details on behavioral traits, error handling, and output expectations, which are important for such an operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 6 parameters. The description adds minimal value beyond the schema by mentioning 'filters, interfaces, and packet limits' and 'saved configurations,' but it doesn't provide additional semantic context or usage examples for the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Start a background packet capture session') and resource ('packet capture session'), distinguishing it from sibling tools like 'analyze_pcap_file' (analysis) and 'stop_capture_session' (termination). It also mentions key capabilities like controlling parameters and using saved configurations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool (starting captures with parameter control), but it doesn't explicitly state when not to use it or name alternatives. For example, it doesn't contrast with 'manage_config' for configuration tasks or specify prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Stop a running capture session and analyze packets. LLMs control all analysis parameters including display filters and output formats. Can use saved configurations.
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session ID returned from start_capture_session | |
| displayFilter | No | Wireshark display filter for analysis (e.g., "tls.handshake.type == 1") | |
| outputFormat | No | Output format: json (-T json), fields (custom -e), or text (default wireshark output) | text |
| customFields | No | Custom tshark field list (only used with outputFormat=fields) | |
| sslKeylogFile | No | ABSOLUTE path to SSL keylog file for TLS decryption | |
| configName | No | Name of saved configuration to use for analysis parameters |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that the tool stops a session and analyzes packets with LLM-controlled parameters, but lacks details on critical behaviors: whether stopping is reversible, if analysis occurs automatically upon stopping, error handling for invalid inputs, or performance implications. This is a significant gap for a tool with mutation and analysis functions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with three sentences that are front-loaded: the first states the core action, the second adds control details, and the third mentions configuration use. Each sentence adds value without redundancy, though it could be slightly more structured by explicitly separating stopping and analysis aspects.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (stopping and analyzing packets with 6 parameters), no annotations, and no output schema, the description is incomplete. It doesn't explain what happens after stopping (e.g., session deletion, data retention), the analysis output format or structure, or error conditions. For a mutation tool with rich parameters, this leaves too many unknowns for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond the schema by mentioning 'LLMs control all analysis parameters including display filters and output formats' and 'Can use saved configurations,' which loosely relates to parameters like 'displayFilter,' 'outputFormat,' and 'configName.' This meets the baseline of 3 when schema coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Stop a running capture session and analyze packets.' It specifies the verb ('stop'), resource ('capture session'), and additional action ('analyze packets'), which distinguishes it from siblings like 'start_capture_session' (starting vs. stopping) and 'analyze_pcap_file' (live session vs. file analysis). However, it doesn't explicitly differentiate from 'manage_config' regarding configuration usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by mentioning 'running capture session' and 'saved configurations,' suggesting it should be used after starting a session and potentially with configurations. It doesn't explicitly state when to use this tool vs. alternatives like 'analyze_pcap_file' for file-based analysis or 'manage_config' for configuration management, leaving some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Each tool has a clearly distinct purpose: analyze_pcap_file handles static file analysis, manage_config deals with configuration management, and start_capture_session/stop_capture_session form a clear lifecycle for live captures. There is no overlap or ambiguity between these functions.
All tools follow a consistent verb_noun pattern with snake_case (analyze_pcap_file, manage_config, start_capture_session, stop_capture_session). The naming is predictable and readable throughout the set.
With 4 tools, the server is well-scoped for packet capture and analysis. Each tool earns its place by covering distinct aspects: static analysis, configuration management, and live capture lifecycle. This is an appropriate number for the domain.
The tool set covers core workflows for packet analysis (static and live) with configuration reuse. Minor gaps exist, such as no direct tool for listing or managing saved capture sessions, but agents can work around this using existing tools like manage_config and stop_capture_session.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
A Model Context Protocol server for Wix AI tools
The Google GKE MCP server is a managed Model Context Protocol server that provides AI applications with tools to manage Google Kubernetes Engine (GKE) clusters and Kubernetes resources. It exposes a structured, discoverable interface that allows AI agents to interact with GKE and Kubernetes APIs, enabling them to inspect cluster configurations, retrieve Kubernetes resource YAMLs, monitor operations like cluster upgrades, diagnose issues, and optimize costs—all without needing to parse text output or use complex kubectl commands.
MCP server for building and testing AI agents with multi-model experimentation and insights.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/tuliperis/SharkMCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server