{
  "added_at": "2026-11-01",
  "additional_evidence_urls": [
    "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js",
    "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js#L48-L180",
    "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js#L182-L300",
    "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/index.js#L301-L364",
    "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/package.json",
    "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/LICENSE"
  ],
  "category": "agent-mcp",
  "description_en": "Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. Three tools capture a few seconds of live traffic and return either a fixed set of IP, port, TCP-flag and HTTP fields, tshark's protocol-hierarchy statistics or TCP conversation statistics; analyze_pcap returns IPs, ports, HTTP URLs and protocol stacks from a saved capture. The remaining tools match captured IPs against the URLhaus blocklist and scan a capture for HTTP Basic, FTP, Telnet and Kerberos credentials, beside the dissection output.",
  "description_zh": "基于 Node.js 的 MCP 服务器，为 LLM 客户端调用 Wireshark 的 tshark；其 README 将用途定位于威胁狩猎、网络诊断和异常检测。三个工具会实时抓取数秒流量，分别返回一组固定的 IP、端口、TCP 标志和 HTTP 字段，tshark 的协议层级统计，或 TCP 会话统计；analyze_pcap 则从已保存的抓包文件中返回 IP、端口、HTTP URL 和协议栈。解析输出之外，其余工具会把抓到的 IP 与 URLhaus 黑名单比对，或在抓包文件中扫描 HTTP Basic、FTP、Telnet 和 Kerberos 凭据。",
  "entry_url": "https://awesomerea.org/resources/wiremcp/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/wiremcp/",
  "evidence_url": "https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/README.md",
  "group": "agents",
  "id": "wiremcp",
  "json_url": "https://awesomerea.org/resources/wiremcp/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/wiremcp/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/wiremcp/index.md",
  "name": "WireMCP",
  "name_zh": "WireMCP 基于 tshark 的流量分析 MCP 服务器",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "Reviewed at main commit 7f45f8b from 2025-07-09, the last of nine commits since 2025-03-28; there are no releases or tags, package.json says 1.0.0 and its test script is a placeholder. It runs with Node.js (the README recommends v16+) after npm install, finds tshark on PATH or in common install locations, and is started by the MCP client as node index.js over stdio; the README lists macOS, Windows and Linux. Each tool also has a matching prompt template.",
    "The live-capture tools default to interface en0 for 5 seconds and need capture permissions on the host; they write temp_capture.pcap in the working directory and delete it afterwards, and packet JSON is trimmed to about 720,000 characters. The server builds tshark shell commands by inserting the interface and file-path arguments without escaping, so it should be exposed only to trusted clients.",
    "Field sets are fixed in the code: there is no arbitrary field extraction, display filter, decode-as or protocol-preference control, and the server does not infer unknown message formats.",
    "check_threats and check_ip_threats download the URLhaus text blocklist from abuse.ch and match IPs locally; although the README mentions multiple threat feeds, the reviewed code queries only URLhaus. The credential scan and threat checks are security heuristics, and their findings need analyst review.",
    "MIT; Wireshark and tshark keep their own GPL terms."
  ],
  "requirements_zh": [
    "审阅对象为 main 分支 2025-07-09 的提交 7f45f8b，是自 2025-03-28 以来九个提交中的最后一个；仓库没有发布版本或标签，package.json 标注为 1.0.0，其测试脚本只是占位。执行 npm install 后用 Node.js 运行（README 建议 v16+），程序会在 PATH 或常见安装位置查找 tshark，并由 MCP 客户端通过 stdio 以 node index.js 启动；README 列出 macOS、Windows 和 Linux。每个工具另有对应的提示词模板。",
    "实时抓包工具默认在 en0 接口上抓取 5 秒，需要主机上的抓包权限；它们会在工作目录写入 temp_capture.pcap，用后删除，数据包 JSON 会被截断到约 720,000 个字符。服务器在构造 tshark shell 命令时直接插入接口名和文件路径参数而不做转义，因此只应向可信客户端开放。",
    "字段集合在代码中固定：不支持任意字段提取、显示过滤器、decode-as 或协议首选项设置，服务器也不会推断未知报文格式。",
    "check_threats 和 check_ip_threats 会从 abuse.ch 下载 URLhaus 文本黑名单，并在本地比对 IP；尽管 README 提到多个威胁情报源，所审阅的代码只查询 URLhaus。凭据扫描和威胁检查属于安全启发式检测，其结果需要分析者复核。",
    "采用 MIT 许可；Wireshark 与 tshark 保留各自的 GPL 条款。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/0xKoda/WireMCP",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}