\n\n---\n\n## What is this?\n\nAn [MCP server](https://modelcontextprotocol.io/introduction) that wraps `tshark` (and optional Wireshark suite tools) into a structured analysis interface. Works with Claude Desktop, Claude Code, Cursor, VS Code, and 18+ other MCP clients.\n\n```\nYou: \"Find all DNS queries going to suspicious domains in this capture.\"\nClaude: [calls wireshark_extract_dns_queries → wireshark_detect_dns_tunnel]\n \"Found repeated high-entropy DNS queries consistent with tunneling: ...\"\n```\n\n---\n\n## Install\n\n**Prerequisites:** Python 3.10+ and [Wireshark](https://www.wireshark.org/) with `tshark` on PATH.\n\nWireshark MCP 3.0 uses the stable MCP Python SDK 2.x line (`mcp>=2.1.1,<3`).\n\n```sh\npip install wireshark-mcp\nwireshark-mcp install # choose from detected MCP clients\n```\n\nRestart your AI client — done.\n\nRun `wireshark-mcp doctor` if anything looks off. See [docs/manual-configuration.md](docs/manual-configuration.md) for manual setup or platform-specific notes.\n\n---\n\n## Quick Start\n\nPoint your AI client at a `.pcap` file and try:\n\n```\nAnalyze capture.pcap using the Wireshark MCP tools.\nStart with wireshark_open_file, then run wireshark_quick_analysis.\nUse wireshark_aggregate for any capture-wide count or distribution.\nWrite findings to report.md.\n```\n\n---\n\n## Tools\n\n52 tools, each backed by real `tshark` output — organized into categories:\n\n| Category | Highlights | Count |\n|----------|-----------|:-----:|\n| **Entry & Workflow** | `wireshark_open_file`, `wireshark_quick_analysis` | 2 |\n| **Packet Analysis** | Packet list, details, bytes, context, stream follow, search, file info | 8 |\n| **Data Extraction** | HTTP requests, DNS queries, arbitrary fields, object export | 4 |\n| **Statistics** | Aggregate/group/distinct/top-k/time buckets, protocol hierarchy, endpoints, conversations, I/O graph, expert info, service response time, flow graph | 8 |\n| **Security & Anomaly** | Credential scan, port scan, DNS tunnel, DoS, beaconing, exfiltration, protocol anomalies, YARA | 8 |\n| **Protocol Analysis** | `wireshark_analyze_protocol` (20 protocols), TCP health, ARP spoofing | 3 |\n| **Decrypt & Dissection** | TLS/WPA decrypt, decryption check, decode-as, protocol preferences | 5 |\n| **Forensics & Enrichment** | TLS fingerprints, file signature scan, GeoIP | 3 |\n| **File Ops, Capture & Suite** | Live capture, interfaces, merge, filter-save, editcap trim/split/dedup/time-shift, frame extract, text2pcap, capabilities | 11 |\n\nOne tool covers 20 protocols rather than 20 tools covering one each: `wireshark_analyze_protocol` takes a `protocol` argument (`tls_handshakes`, `mqtt`, `modbus`, `s7comm`, `zigbee`, `wifi`, `rtp`, `kerberos`, …) and applies the right fields and display filter for it. The field names are the point — `s7comm.param.item.dbnum` is not something a caller should have to guess, and a wrong guess returns an empty result that reads like a clean capture.\n\nThe server starts with only `tshark` required. Optional tools (`capinfos`, `mergecap`, `editcap`, `dumpcap`, `text2pcap`) are auto-detected and enable extra features when present.\n\n### Context cost\n\nThe tool list travels in the prompt prefix of every request your client sends, so its size is a fixed per-request cost. The default surface is ~22 KB — about 9 KB of parameter schema, 5 KB of descriptions, and 3 KB of read/write annotations — and it is byte-identical across restarts so clients can cache the prefix rather than re-reading it each session.\n\nIf your client never captures live traffic or writes pcaps, `--profile` advertises less:\n\n| Profile | Tools | Payload | Drops |\n|---------|:-----:|:-------:|-------|\n| `full` (default) | 52 | ~22 KB | nothing |\n| `analysis` | 40 | ~17 KB | live capture, interface listing, all file-writing tools |\n| `core` | 32 | ~14 KB | the above, plus decryption, dissection overrides, and low-level views |\n\n```bash\nwireshark-mcp serve --profile core\n```\n\nRuntime prompts and protocol recommendations respect the selected profile. Static guides may describe `full`-only workflows, but the server never recommends an excluded tool during capture discovery.\n\nTool results are bounded too, since a result stays in the conversation for the rest of the session. Output over 8000 characters is truncated head-and-tail with a marker, and the tool's `offset` / `limit` / `display_filter` parameters are the way to page through the rest. Raise or lower the ceiling with:\n\n```bash\nexport WIRESHARK_MCP_MAX_RESULT_CHARS=16000\n```\n\nEvery tool also declares whether it reads or writes, so clients can auto-approve the 41 read-only analysis tools and still prompt for the 11 that create files (live capture, merge, filter-save, editcap, text2pcap, frame extract, object export).\n\nIn 3.0, those 11 tools fail closed until `WIRESHARK_MCP_ALLOWED_DIRS` names existing directories. Remote HTTP/SSE binding also stays loopback-only unless `--allow-insecure-http` is explicitly supplied behind a trusted authenticated TLS proxy. See the [3.0 security migration guide](docs/security-hardening-v3.md).\n\n---\n\n## Documentation\n\n| Topic | Link |\n|-------|------|\n| Documentation index | [docs/README.md](docs/README.md) |\n| Capture-wide aggregation | [docs/aggregation.md](docs/aggregation.md) |\n| Platform setup (macOS/Linux/Windows) | [docs/platform-validation.md](docs/platform-validation.md) |\n| Manual client configuration | [docs/manual-configuration.md](docs/manual-configuration.md) |\n| Deployment scenarios | [docs/deployment-scenarios.md](docs/deployment-scenarios.md) |\n| 3.0 security migration | [docs/security-hardening-v3.md](docs/security-hardening-v3.md) |\n| Prompt templates | [docs/prompt-engineering.md](docs/prompt-engineering.md) |\n| Architecture | [docs/architecture.md](docs/architecture.md) |\n| Release checklist | [docs/release-checklist.md](docs/release-checklist.md) |\n| Contributing | [CONTRIBUTING.md](CONTRIBUTING.md) |\n| Changelog | [CHANGELOG.md](CHANGELOG.md) |\n| Feature roadmap | [ROADMAP.md](ROADMAP.md) |\n| Security policy | [SECURITY.md](SECURITY.md) |\n\n---\n\n## Development\n\n```sh\npip install -e \".[dev]\"\npytest tests/ -v\nruff check src/ tests/\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for the full guide.\n\n---\n\n![\"Wireshark](\"Logo.png\")
\n\n![\"CI\"](\"https://img.shields.io/github/actions/workflow/status/bx33661/Wireshark-MCP/ci.yml?style=flat-square&logo=github&label=CI\")
![\"GitHub](\"https://img.shields.io/github/v/release/bx33661/Wireshark-MCP?style=flat-square&logo=github&color=24292f\")
![\"PyPI\"](\"https://img.shields.io/pypi/v/wireshark-mcp?style=flat-square&logo=pypi&color=0066cc\")
![\"Python\"](\"https://img.shields.io/pypi/pyversions/wireshark-mcp?style=flat-square&logo=python\")
![\"MIT](\"https://img.shields.io/badge/License-MIT-green.svg?style=flat-square\"){kind=icon}
\n \n