Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@packmate-mcp get stream 42 with transcript format"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server that exposes Packmate — a CTF network traffic analyzer — to LLM tooling like Claude Desktop or Claude Code.
16 tools across services, patterns, streams, packets, and pcap-file lifecycle.
Packet content formatting tuned for LLM consumption: transcript (auto text/hex with client→server markers), text, hex, python_bytes, base64.
Three-layer trimming (per-packet, total budget, packet count) to keep responses inside the LLM context window.
Pure async httpx client over Packmate's HTTP API + Basic Auth.
stdio transport — drop into Claude Desktop or Claude Code as a subprocess.
Related MCP server: TShark2MCP
uvx packmate-mcp # ephemeral, recommended
# or
pip install packmate-mcpAll settings are env vars with the PACKMATE_MCP_ prefix:
Env var | Default | Description |
|
| Packmate base URL |
| (required) | Basic auth login |
| (required) | Basic auth password |
|
| HTTP request timeout |
|
|
|
See .env.example for a starter template.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %AppData%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"packmate": {
"command": "uvx",
"args": ["packmate-mcp"],
"env": {
"PACKMATE_MCP_BASE_URL": "http://localhost:65000",
"PACKMATE_MCP_LOGIN": "BinaryBears",
"PACKMATE_MCP_PASSWORD": "..."
}
}
}
}Restart Claude Desktop fully (Cmd+Q / tray → Quit), then look for the connector under the + menu.
claude mcp add packmate uvx packmate-mcp \
--env PACKMATE_MCP_LOGIN=BinaryBears \
--env PACKMATE_MCP_PASSWORD=...See the design spec for the full list. Highlights:
get_stream(stream_id, content_format='transcript') — fetch a stream with packets pre-rendered. Most common entrypoint.
create_pattern + pattern_lookback + list_streams(pattern_id=…) — the native Packmate workflow for content search.
set_stream_favorite(stream_id, favorite=True/False) — pin interesting streams.
pcap_status / pcap_start — kick off pcap-file processing in FILE mode.
git clone https://github.com/umbra2728/packmate-mcp
cd packmate-mcp
uv sync --dev
uv run pytest
uv run ruff check src tests
uv run mypy srcManual smoke test against a real Packmate instance:
# in the Packmate repo
docker compose up -d
# back here
PACKMATE_MCP_LOGIN=BinaryBears PACKMATE_MCP_PASSWORD=123456 \
uv run mcp dev src/packmate_mcp/server.pyThis opens the MCP Inspector and lets you exercise each tool.
This package ships to PyPI via Trusted Publishing. The workflow runs on any v*.*.* tag.
Bump version in pyproject.toml.
Add a ## [X.Y.Z] - YYYY-MM-DD section to CHANGELOG.md.
Commit, tag, push:
git commit -am "Release vX.Y.Z"
git tag vX.Y.Z
git push --tagsOne-time setup (not in repo state):
On PyPI → Account settings → Add a pending publisher with repo umbra2728/packmate-mcp, workflow release.yml, environment pypi.
On GitHub → repo → Settings → Environments → create pypi.
firegex-mcp — sibling MCP server for Firegex (PCRE2 regex / proxy WAF).
ad-ctf-toolkit — Claude Code plugin that combines packmate-mcp and firegex-mcp with skills and sub-agents for Attack/Defense CTF rounds.
Questions, suggestions, bug reports, or anything else — reach out:
Telegram: @ismailgaleev
Email: umbra2728@gmail.com
GitHub Issues: preferred for actionable bugs and feature requests
MIT — see LICENSE.
Create a pattern.
action_type=FIND highlights matches; IGNORE deletes streams that match.
search_type: SUBSTRING (text), REGEX (Java regex), BINARY (hex bytes).
direction_type: INPUT (client→server), OUTPUT (server→client), BOTH.
service_port: scope to one service; leave None for all services.
Inputs: name (required), value (required), action_type (required), search_type (required), +3 more. Returns: id, name, value, color, +5 more
Create a new service.
For HTTP-like services, enable urldecode_http_requests, merge_adjacent_packets,
and http. For binary services, leave them off.
Inputs: name (required), port (required), merge_adjacent_packets, urldecode_http_requests, +3 more. Returns: id, name, port, mergeAdjacentPackets, +4 more
Delete a pattern.
Inputs: pattern_id (required). Returns: result
Delete the service registered on port.
Inputs: port (required). Returns: result
Read a page of packets from a stream.
Use this instead of get_stream when a stream is too large or you need to
scroll past the first page. Set starting_from to a packet id (returned in
the previous page) to continue scrolling.
Returns {packets: [<metadata>], content: <formatted string>}.
Inputs: stream_id (required), starting_from, page_size, content_format, +1 more. Returns: object
Get one stream by id with its packets pre-formatted.
Returns {stream: <metadata>, content: <formatted string>}.
content_format: transcript (default), text, hex, python_bytes, base64.
The three max_* parameters cap the output to fit within an LLM context window.
Widen them if you need more detail; narrow them for large binary streams.
Inputs: stream_id (required), content_format, max_bytes_per_packet, total_max_bytes, +1 more. Returns: object
List all patterns (highlight + ignore).
Inputs: no named parameters. Returns: result
List all configured Packmate services.
Inputs: no named parameters. Returns: result
List streams (newest first).
port: restrict to one service.
starting_from: return streams with id strictly less than this value (for pagination).
favorites=True: only favorited streams.
pattern_id: only streams that matched the given pattern. Combine with
create_pattern + pattern_lookback to search content retroactively.
Inputs: port, starting_from, page_size, favorites, +1 more. Returns: result
Apply a pattern to streams captured in the last N minutes (N >= 1).
Useful after creating a new pattern to retroactively scan recent traffic.
Inputs: pattern_id (required), minutes (required). Returns: result
Begin processing the configured pcap file (FILE mode only).
Packmate silently ignores this call outside FILE mode. The tool follows up
with pcap_status and returns a note if processing did not start.
Inputs: no named parameters. Returns: object
Whether pcap-file processing has been started (FILE mode only).
Inputs: no named parameters. Returns: object
Enable or disable a pattern without deleting it.
Inputs: pattern_id (required), enabled (required). Returns: result
Mark or unmark a stream as favorite.
Note: Packmate returns 200 even if the stream id does not exist (no row updated).
Inputs: stream_id (required), favorite (required). Returns: result
Update a pattern. Only provided fields are changed.
Inputs: pattern_id (required), name, value, color, +4 more. Returns: id, name, value, color, +5 more
Update a service. Only provided fields are changed.
Inputs: port (required), name, merge_adjacent_packets, urldecode_http_requests, +3 more. Returns: id, name, port, mergeAdjacentPackets, +4 more
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 16 tools
Each tool targets a distinct action on a specific resource: patterns, services, streams, packets, pcap control, and favorites. There is no overlap or ambiguity between tools like create_pattern and update_pattern.
Tools generally follow a verb_noun pattern (create_pattern, delete_service, list_streams), with a few deviations like pcap_start (noun_verb) and pattern_lookback (noun_lookback). Overall consistent with minor exceptions.
With 16 tools, the set is slightly over the typical 3-15 range but still well-scoped for network traffic analysis, covering CRUD for patterns and services, stream/packet retrieval, pcap control, and favorites.
Core workflows are covered: managing patterns and services, browsing streams, retrieving packets, and controlling pcap files. Minor gaps include lack of pcap_stop or stream deletion, but most use cases are supported.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
MCP server for AI dialogue using various LLM models via AceDataCloud
MCP Server for Slima - AI Writing IDE for Novel Authors with AI Beta Reader.
