{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/src/wireshark_mcp/tools/advanced.py",
    "https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/src/wireshark_mcp/server.py",
    "https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/docs/security-hardening-v3.md",
    "https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/pyproject.toml",
    "https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/LICENSE",
    "https://github.com/bx33661/Wireshark-MCP/releases/tag/v3.1.0",
    "https://pypi.org/project/wireshark-mcp/3.1.0/"
  ],
  "category": "agent-mcp",
  "description_en": "MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. Separate security-heuristic, live-capture and capture-editing tools sit beside the dissection tools.",
  "description_zh": "封装 tshark 及可选的其他 Wireshark 命令行工具的 MCP 服务器，使智能体能借助 Wireshark 的解析器查询已保存的抓包文件：数据包列表与详情、流追踪、任意字段提取、协议层级与会话统计、针对非标准端口的 decode-as 规则、协议首选项、使用用户提供的密钥进行 TLS 与 WPA 解密，以及一个为 Modbus、S7comm、MQTT、Zigbee、BLE 等 25 种协议套用预设字段和过滤器的工具。解析类工具之外，另有安全启发式检测、实时抓包和抓包文件编辑等独立工具。",
  "entry_url": "https://awesomerea.org/resources/wireshark-mcp/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/wireshark-mcp/",
  "evidence_url": "https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/README.md",
  "group": "agents",
  "id": "wireshark-mcp",
  "json_url": "https://awesomerea.org/resources/wireshark-mcp/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/wireshark-mcp/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/wireshark-mcp/index.md",
  "name": "Wireshark MCP",
  "name_zh": "Wireshark MCP 基于 tshark 的协议解析服务器",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "Python 3.10+ and Wireshark with tshark on PATH; capinfos, mergecap, editcap, dumpcap and text2pcap are auto-detected optional extras, and live capture needs the platform's capture drivers and permissions. Install from PyPI (wireshark-mcp 3.1.0, built on MCP Python SDK 2.x) with its client installer, or through the Claude Code or Codex plugin route with uv. Reviewed at the v3.1.0 tag, released 2026-10-18 at the main head; the project changes quickly.",
    "stdio is the default transport. SSE and streamable HTTP bind 127.0.0.1 by default and are unauthenticated, so the server refuses a non-loopback bind unless --allow-insecure-http is passed behind a trusted authenticated TLS proxy. The 11 file-writing tools (live capture, merge, filter-save, editcap, text2pcap, frame and object export) fail closed until WIRESHARK_MCP_ALLOWED_DIRS names existing directories; --profile analysis or core advertises fewer tools.",
    "Protocol results come from Wireshark's existing dissectors and preset field lists; decode-as rules and preferences only redirect or configure those dissectors, and the server does not infer unknown message formats. Credential, scan, tunnelling, beaconing, exfiltration and YARA tools are security heuristics rather than protocol reverse engineering, and their findings need analyst review.",
    "MIT; Wireshark and its tools keep their own GPL terms."
  ],
  "requirements_zh": [
    "需要 Python 3.10+，以及 tshark 位于 PATH 中的 Wireshark；capinfos、mergecap、editcap、dumpcap 和 text2pcap 为自动检测的可选组件，实时抓包还需要所在平台的抓包驱动与权限。可从 PyPI 安装（wireshark-mcp 3.1.0，基于 MCP Python SDK 2.x）并使用其客户端安装器，也可借助 uv 走 Claude Code 或 Codex 插件安装路线。审阅对象为 v3.1.0 标签，于 2026-10-18 在 main 分支最新提交上发布；项目更新很快。",
    "默认传输方式为 stdio。SSE 和 streamable HTTP 默认绑定 127.0.0.1 且没有认证，因此除非在可信且带认证的 TLS 代理之后传入 --allow-insecure-http，服务器会拒绝绑定非回环地址。11 个写文件工具（实时抓包、合并、过滤保存、editcap、text2pcap、帧导出与对象导出）在 WIRESHARK_MCP_ALLOWED_DIRS 指定已存在的目录之前一律拒绝执行；--profile analysis 或 core 可减少对外公布的工具。",
    "协议结果来自 Wireshark 现有的解析器和预设字段列表；decode-as 规则与协议首选项只是重定向或配置这些解析器，服务器不会推断未知的报文格式。凭据扫描、端口扫描、隧道、信标、数据外传和 YARA 等工具属于安全启发式检测，而非协议逆向，其结果需要分析者复核。",
    "采用 MIT 许可；Wireshark 及其工具保留各自的 GPL 条款。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/bx33661/Wireshark-MCP",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}