# WireMCP

> Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. Three tools capture a few seconds of live traffic and return either a fixed set of IP, port, TCP-flag and HTTP fields, tshark's protocol-hierarchy statistics or TCP conversation statistics; analyze_pcap returns IPs, ports, HTTP URLs and protocol stacks from a saved capture. The remaining tools match captured IPs against the URLhaus blocklist and scan a capture for HTTP Basic, FTP, Telnet and Kerberos credentials, beside the dissection output.

- Type: Integration
- Targets: Protocol
- Category: Independent MCP integrations
- Relationship: Independent agent integration
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-11-01
- Original resource: <https://github.com/0xKoda/WireMCP>
- Primary source: <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/README.md>
- Catalog page: <https://awesomerea.org/resources/wiremcp/>
- Record JSON: <https://awesomerea.org/resources/wiremcp/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/wiremcp/index.md)

## Requirements & limits

- Reviewed at main commit 7f45f8b from 2025-07-09, the last of nine commits since 2025-03-28; there are no releases or tags, package.json says 1.0.0 and its test script is a placeholder. It runs with Node.js (the README recommends v16+) after npm install, finds tshark on PATH or in common install locations, and is started by the MCP client as node index.js over stdio; the README lists macOS, Windows and Linux. Each tool also has a matching prompt template.
- The live-capture tools default to interface en0 for 5 seconds and need capture permissions on the host; they write temp_capture.pcap in the working directory and delete it afterwards, and packet JSON is trimmed to about 720,000 characters. The server builds tshark shell commands by inserting the interface and file-path arguments without escaping, so it should be exposed only to trusted clients.
- Field sets are fixed in the code: there is no arbitrary field extraction, display filter, decode-as or protocol-preference control, and the server does not infer unknown message formats.
- check_threats and check_ip_threats download the URLhaus text blocklist from abuse.ch and match IPs locally; although the README mentions multiple threat feeds, the reviewed code queries only URLhaus. The credential scan and threat checks are security heuristics, and their findings need analyst review.
- MIT; Wireshark and tshark keep their own GPL terms.

## Primary sources

1. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/README.md>
2. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js>
3. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js#L48-L180>
4. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js#L182-L300>
5. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js#L301-L364>
6. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/package.json>
7. <https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/LICENSE>

## More in Agents and MCP

- [ReverserAI](https://awesomerea.org/resources/reverser-ai/index.md) · Integration
- [WPeGPT](https://awesomerea.org/resources/wpegpt/index.md) · Integration
- [IDAssist](https://awesomerea.org/resources/idassist/index.md) · Integration
- [GhidraGPT](https://awesomerea.org/resources/ghidragpt/index.md) · Integration
- [GhidrAssist](https://awesomerea.org/resources/ghidrassist/index.md) · Integration
- [Rikugan](https://awesomerea.org/resources/rikugan/index.md) · Integration

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.