Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Integration

WireMCP

Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. Three tools capture a few seconds of live traffic and return either a fixed set of IP, port, TCP-flag and HTTP fields, tshark's protocol-hierarchy statistics or TCP conversation statistics; analyze_pcap returns IPs, ports, HTTP URLs and protocol stacks from a saved capture. The remaining tools match captured IPs against the URLhaus blocklist and scan a capture for HTTP Basic, FTP, Telnet and Kerberos credentials, beside the dissection output.

Targets
Protocol
Category
Independent MCP integrations
Relationship
Independent agent integration
Sources reviewed

Requirements & limits

  • Reviewed at main commit 7f45f8b from 2025-07-09, the last of nine commits since 2025-03-28; there are no releases or tags, package.json says 1.0.0 and its test script is a placeholder. It runs with Node.js (the README recommends v16+) after npm install, finds tshark on PATH or in common install locations, and is started by the MCP client as node index.js over stdio; the README lists macOS, Windows and Linux. Each tool also has a matching prompt template.
  • The live-capture tools default to interface en0 for 5 seconds and need capture permissions on the host; they write temp_capture.pcap in the working directory and delete it afterwards, and packet JSON is trimmed to about 720,000 characters. The server builds tshark shell commands by inserting the interface and file-path arguments without escaping, so it should be exposed only to trusted clients.
  • Field sets are fixed in the code: there is no arbitrary field extraction, display filter, decode-as or protocol-preference control, and the server does not infer unknown message formats.
  • check_threats and check_ip_threats download the URLhaus text blocklist from abuse.ch and match IPs locally; although the README mentions multiple threat feeds, the reviewed code queries only URLhaus. The credential scan and threat checks are security heuristics, and their findings need analyst review.
  • MIT; Wireshark and tshark keep their own GPL terms.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  2. index.js GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  3. index.js#L48-L180 GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  4. index.js#L182-L300 GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  5. index.js#L301-L364 GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  6. package.json GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  7. LICENSE GitHub · 0xKoda/WireMCP · Revision 7f45f8b

More in Agents and MCP

All 87 entries in Agents and MCP

↑↓ move↵ open⌘↵ new tab