List all configured Packmate services.

Create a new service.

For HTTP-like services, enable urldecode_http_requests, merge_adjacent_packets, and http. For binary services, leave them off.

Update a service. Only provided fields are changed.

Delete the service registered on port.

List all patterns (highlight + ignore).

Create a pattern.

action_type=FIND highlights matches; IGNORE deletes streams that match. search_type: SUBSTRING (text), REGEX (Java regex), BINARY (hex bytes). direction_type: INPUT (client→server), OUTPUT (server→client), BOTH. service_port: scope to one service; leave None for all services.

Update a pattern. Only provided fields are changed.

Delete a pattern.

Enable or disable a pattern without deleting it.

Apply a pattern to streams captured in the last N minutes (N >= 1).

Useful after creating a new pattern to retroactively scan recent traffic.

List streams (newest first).

• port: restrict to one service.

• starting_from: return streams with id strictly less than this value (for pagination).

• favorites=True: only favorited streams.

• pattern_id: only streams that matched the given pattern. Combine with create_pattern + pattern_lookback to search content retroactively.

Mark or unmark a stream as favorite.

Note: Packmate returns 200 even if the stream id does not exist (no row updated).

Get one stream by id with its packets pre-formatted.

Returns {stream: <metadata>, content: <formatted string>}.

content_format: transcript (default), text, hex, python_bytes, base64. The three max_* parameters cap the output to fit within an LLM context window. Widen them if you need more detail; narrow them for large binary streams.

Read a page of packets from a stream.

Use this instead of get_stream when a stream is too large or you need to scroll past the first page. Set starting_from to a packet id (returned in the previous page) to continue scrolling.

Returns {packets: [<metadata>], content: <formatted string>}.

Whether pcap-file processing has been started (FILE mode only).

Begin processing the configured pcap file (FILE mode only).

Packmate silently ignores this call outside FILE mode. The tool follows up with pcap_status and returns a note if processing did not start.