Allows interception of TLS traffic in applications using OpenSSL, capturing plaintext data before encryption and after decryption for network analysis.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@YouNetMonitor-MCP Attach to Spotify and show me its decrypted HTTPS traffic"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for attaching Frida-based network/traffic interceptors (TCP/UDP/TLS) to any application — built on deluder.
YouNetMonitor-MCP exposes deluder's traffic-interception capabilities as 15 Model Context Protocol tools, so an AI assistant (Claude Desktop, VS Code, Copilot, etc.) can:
List running processes on the local or a remote machine
Attach Frida hooks to any process by PID or by name
Spawn a new app with hooks already attached
Intercept TCP/UDP traffic (Winsock, libc sockets) and TLS traffic (OpenSSL, GnuTLS, SChannel) in plaintext before encryption / after decryption
Drain captured events as JSON-RPC tool results
Search captured payloads by substring (ASCII or hex)
Manage multiple parallel capture sessions
The full deluder/ package (v1.2.1) is vendored in this repo so no separate install is needed. deluder is GPL-3.0; this derivative inherits the same license.
Deluder script | Library | Hooks |
|
| send, sendto, recv, recvfrom, WSASend, WSASendTo, WSARecv, WSARecvFrom |
|
| send, sendto, recv, recvfrom |
|
| SSL_write, SSL_write_ex, SSL_read, SSL_read_ex |
|
| gnutls_record_send, gnutls_record_recv |
|
| EncryptMessage, DecryptMessage |
Related MCP server: fuzzmind-frida-mcp
┌─────────────────────────────────────────────────────────────┐
│ MCP Client (Claude / VS Code / Copilot) │
│ ▼ MCP protocol (stdio) │
├─────────────────────────────────────────────────────────────┤
│ YouNetMonitor-MCP Server │
│ ┌────────────────────────┐ ┌──────────────────────────┐ │
│ │ Session Manager │ │ 14 MCP Tools │ │
│ │ (per-session thread + │ │ (attach/spawn/drain/ │ │
│ │ in-memory ring buffer)│ │ search/stop/stats) │ │
│ └──────────┬─────────────┘ └──────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ deluder (vendored, GPL-3.0) ││
│ │ Frida-based dynamic instrumentation engine ││
│ └──────────┬──────────────────────────────────────────────┘│
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ Frida runtime + JS hook scripts ││
│ │ (winsock.js, openssl.js, schannel.js, gnutls.js, libc) ││
│ └──────────┬──────────────────────────────────────────────┘│
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ Target process (local PID or remote frida-server host) ││
│ │ - any Windows / Linux / macOS app ││
│ │ - captures TCP/UDP + decrypted TLS in plaintext ││
│ └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘Requirements: Python 3.10+, Frida runtime (pip-installable)
# From source
git clone https://github.com/YouKnowMako/YouNetMonitor-MCP.git
cd YouNetMonitor-MCP
pip install -e .
# Verify
younetmonitor-mcp --version
younetmonitor-mcp --list-toolsAdd to claude_desktop_config.json:
{
"mcpServers": {
"younetmonitor": {
"command": "younetmonitor-mcp"
}
}
}.vscode/mcp.json){
"mcpServers": {
"younetmonitor": {
"command": "python",
"args": ["-m", "younetmonitor"]
}
}
}If your bridge spawns MCP servers via command + args, register YouNetMonitor-MCP the same way you would any stdio MCP server.
Tool | Description |
| Server version, deluder version, available scripts/interceptors |
| List networking-library hook scripts (winsock, libc, openssl, gnutls, schannel) |
| List interceptor modules (log, proxifier, petep, buffer) |
| List running processes (local or remote frida-server) |
| Find a process by name (exact or substring match) |
| Attach deluder to a running PID/process-name → returns |
| Spawn a new app with deluder attached → returns |
| List all active capture sessions with status and config |
| Get detailed status of a single session (state, pid, error, stats) |
| Stop a capture session (detaches frida; for spawned apps, kills the app) |
| Remove a stopped session from the registry |
| Drain (or peek) captured events, optionally filtered by timestamp/direction |
| Search captured payloads by substring (ASCII or hex) |
| Per-session stats: total buffered, counts by direction, buffer capacity |
| Default session config as a template |
In natural language:
"Find the process
Telegram.exe, attach deluder to it, then capture all TLS traffic for 30 seconds. Show me any event containing the wordaccount."
Under the hood, the MCP client makes these tool calls:
ynm_get_process_by_name({ "name": "Telegram.exe" }) → { "found": true, "pid": 12345 }
ynm_attach_to_process({ "target": "12345", "scripts": ["openssl", "schannel"] }) → { "session": { "session_id": "sess_abc123", "state": "running", ... } }
wait 30 seconds
ynm_search_events({ "session_id": "sess_abc123", "needle": "account" }) → { "matches": [ { "ts": ..., "direction": "send", "data_ascii": "POST /api/account HTTP/1.1\r\n..." } ] }
ynm_stop_session({ "session_id": "sess_abc123" })
To intercept a process on a different machine:
On the remote machine, download and run frida-server:
frida-server -l 0.0.0.0:27042From the MCP client, pass remote_host: "REMOTE_IP:27042" to ynm_attach_to_process (or ynm_spawn_process, ynm_list_processes).
YouNetMonitor-MCP adds a new buffer interceptor to deluder's pipeline. When deluder's Frida hooks fire (e.g. SSL_write inside the target process), the captured data flows:
Frida JS hook (in target process)
↓ send() message
deluder MessageRouter
↓ route()
BufferMessageInterceptor.intercept()
↓ CaptureEvent stored in deque(maxlen=N)
SessionManager (per-session thread)
↓ drained via ynm_get_events tool
MCP JSON-RPC response to the clientEach session has its own background thread (deluder's delude() is blocking), and its own bounded ring buffer. The buffer is drained by the ynm_get_events MCP tool.
Plaintext only when the TLS library is hookable. If an app uses a statically-linked TLS stack with no exported symbols (some game engines, embedded Chromium-based UIs), deluder can't intercept plaintext — you'd see raw encrypted bytes instead. Use ynm_list_supported_scripts to see which libraries are hookable.
Plaintext TLS hooks capture before encryption / after decryption. This means the bytes you see in data_ascii are the actual HTTP/protocol payloads — headers, body, query strings, etc.
Buffer is in-memory only. Restart the server and buffered events are lost. For persistent capture, write events to a file from a downstream interceptor.
GPL-3.0 license. Inherited from deluder. Commercial use requires source-code disclosure of derivatives.
YouNetMonitor-MCP/
├── younetmonitor/
│ ├── __init__.py # Package exports
│ ├── __main__.py # python -m younetmonitor
│ ├── common.py # Constants, data classes
│ ├── session.py # Session manager (per-session deluder thread)
│ ├── mcp_server.py # MCP stdio JSON-RPC server (14 tools)
│ └── interceptors/
│ ├── __init__.py # Registers 'buffer' in deluder's registry
│ └── buffer.py # In-memory ring buffer interceptor
├── deluder/ # Vendored deluder v1.2.1 (GPL-3.0)
│ ├── common.py
│ ├── core.py
│ ├── interceptors/ # log, proxifier, petep, (buffer added at runtime)
│ └── scripts/ # winsock.js, openssl.js, schannel.js, gnutls.js, libc.js
├── tests/
│ └── test_mcp_server.py # Smoke tests for tool dispatch and protocol
├── examples/
│ └── usage.py # Standalone Python example (no MCP client needed)
├── pyproject.toml
├── requirements.txt
├── LICENSE.md # GPL-3.0
└── README.mddeluder by Warxim — the underlying Frida-based traffic interception engine, vendored unchanged.
Frida — dynamic instrumentation toolkit.
GNU General Public License v3.0 — inherited from deluder.
This server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server for Appcircle mobile CI/CD platform.
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/YouKnowMako/YouNetMonitor-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server