Integration
Wireshark MCP
MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. Separate security-heuristic, live-capture and capture-editing tools sit beside the dissection tools.
- Targets
- Protocol
- Category
- Independent MCP integrations
- Relationship
- Independent agent integration
- Sources reviewed
Requirements & limits
- Python 3.10+ and Wireshark with tshark on PATH; capinfos, mergecap, editcap, dumpcap and text2pcap are auto-detected optional extras, and live capture needs the platform's capture drivers and permissions. Install from PyPI (wireshark-mcp 3.1.0, built on MCP Python SDK 2.x) with its client installer, or through the Claude Code or Codex plugin route with uv. Reviewed at the v3.1.0 tag, released 2026-10-18 at the main head; the project changes quickly.
- stdio is the default transport. SSE and streamable HTTP bind 127.0.0.1 by default and are unauthenticated, so the server refuses a non-loopback bind unless --allow-insecure-http is passed behind a trusted authenticated TLS proxy. The 11 file-writing tools (live capture, merge, filter-save, editcap, text2pcap, frame and object export) fail closed until WIRESHARK_MCP_ALLOWED_DIRS names existing directories; --profile analysis or core advertises fewer tools.
- Protocol results come from Wireshark's existing dissectors and preset field lists; decode-as rules and preferences only redirect or configure those dissectors, and the server does not infer unknown message formats. Credential, scan, tunnelling, beaconing, exfiltration and YARA tools are security heuristics rather than protocol reverse engineering, and their findings need analyst review.
- MIT; Wireshark and its tools keep their own GPL terms.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
- src/wireshark_mcp/tools/advanced.py GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
- src/wireshark_mcp/server.py GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
- docs/security-hardening-v3.md GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
- pyproject.toml GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
- LICENSE GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
- https://github.com/bx33661/Wireshark-MCP/releases/tag/v3.1.0
- https://pypi.org/project/wireshark-mcp/3.1.0/
More in Agents and MCP
- BINNY · Integration
- decomp.wtf · Integration
- Claude Intercept · Integration
- Ghidra MCP Server (bethington) · Integration
- DecompilerServer · Integration
- Gepetto · Integration