Skip to content
Agentmart
Submit a tool

Wireshark MCP

Professional network analysis with tshark.

Connector by bx33661 · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 352
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/bx33661-wireshark-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Professional network analysis with tshark. Security audits, deep-dives, and threat detection.

Use cases: security-scanning, incident-response

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
19 read · 5 write · 1 delete · 11 not yet classified
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 36

Read from the source code; the running server may list different tools.

Read 19 · Look things up without changing anything.

  • wireshark_capture
  • wireshark_extract_fields
  • wireshark_extract_frames
  • wireshark_flow_graph
  • wireshark_get_capabilities
  • wireshark_get_file_info
  • wireshark_get_packet_bytes
  • wireshark_get_packet_context
  • wireshark_get_packet_details
  • wireshark_get_packet_list
  • wireshark_list_interfaces
  • wireshark_read_packets
Show 7 more tools
  • wireshark_search_packets
  • wireshark_stats_conversations
  • wireshark_stats_endpoints
  • wireshark_stats_expert_info
  • wireshark_stats_io_graph
  • wireshark_stats_protocol_hierarchy
  • wireshark_stats_service_response_time

Write 5 · Create, change, send or run things.

  • wireshark_filter_save
  • wireshark_follow_stream
  • wireshark_merge_pcaps
  • wireshark_set_protocol_prefs
  • wireshark_text2pcap_import

Delete 1 · Delete, drop, revoke or wipe things.

  • wireshark_editcap_deduplicate

Not yet classified 11 · We could not tell from the name and description.

  • wireshark_aggregate
  • wireshark_case
  • wireshark_decode_as
  • wireshark_decrypt_tls
  • wireshark_decrypt_wpa
  • wireshark_editcap_split
  • wireshark_editcap_time_shift
  • wireshark_editcap_trim
  • wireshark_index
  • wireshark_open_file
  • wireshark_quick_analysis

Tools (36)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • wireshark_aggregate

    [Primary statistics] Full-filter counts, groups, distinct values, numeric metrics, top-k, and time buckets. Field lists are comma-separated.

  • wireshark_capture

    Capture live network traffic. capture_filter: BPF syntax. ring_buffer: "filesize:1024,files:5".

  • wireshark_case

    [Case] Saved investigation. create(text=title,target=pcaps) record(text=tool JSON) verdict(target=finding id,text=confirmed|dismissed|open: note) note show report list

  • wireshark_decode_as

    [Dissection] Decode-as for non-standard ports. Rules: 'tcp.port==8080,http;udp.port==5353,dns'.

  • wireshark_decrypt_tls

    [Decrypt] Decrypt TLS traffic using SSLKEYLOGFILE, show HTTP data.

  • wireshark_decrypt_wpa

    [Decrypt] Decrypt WPA/WPA2 traffic with passphrase (+SSID).

  • wireshark_editcap_deduplicate

    Remove duplicate packets within a sliding window (default: 5 packets).

  • wireshark_editcap_split

    Split a capture into smaller files by packet count or interval.

  • wireshark_editcap_time_shift

    Adjust all packet timestamps by a positive or negative offset in seconds.

  • wireshark_editcap_trim

    Trim capture to a timestamp window. Times in editcap format.

  • wireshark_extract_fields

    [Tabular] Extract fields as TSV. fields: comma-separated; limit/offset count lines including the header.

  • wireshark_extract_frames

    [File] Extract specific frame ranges to a new pcap. Ranges: '1-10 15 20-30'.

  • wireshark_filter_save

    Filter packets from a pcap and save to a new file using a Wireshark display filter.

  • wireshark_flow_graph

    [Stats] Flow/sequence graph showing packet exchange. Types: 'any', 'tcp', 'icmp'.

  • wireshark_follow_stream

    [Stream] Reassemble stream with pagination. protocol: tcp|udp|tls|http|http2. output_mode: ascii|hex|raw.

Show 21 more tools
  • wireshark_get_capabilities

    Get Wireshark suite capabilities for this MCP server instance (available tools and versions).

  • wireshark_get_file_info

    Get capture file metadata (type, packet count, duration, size) via capinfos.

  • wireshark_get_packet_bytes

    [Bytes] Raw hex/ASCII dump of a single packet.

  • wireshark_get_packet_context

    [Context] Packets surrounding a specific frame (count before and after).

  • wireshark_get_packet_details

    [Detail] Full JSON for one packet. layers: comma-separated protocol filter (e.g. "ip,tcp,http").

  • wireshark_get_packet_list

    [Summary] Packet list (top pane). TSV: No/Time/Src/Dst/Proto/Len/Info. custom_columns: comma-separated fields.

  • wireshark_index

    [Index] Build once; aggregate/extract_fields reuse it. more_files: extra captures (capture_id). query: SELECT on packets/pkt/flows/captures. timeline: first/last seen. diff: vs more_files/compare_filter. export: Parquet.

  • wireshark_list_interfaces

    List available network interfaces for capture.

  • wireshark_merge_pcaps

    Merge multiple capture files into one. input_files: comma-separated paths.

  • wireshark_open_file

    [Entry Point] Open a pcap and get protocol-aware tool recommendations. Returns protocols and relevant tools.

  • wireshark_quick_analysis

    [Agent] One-call traffic overview: file info, protocols, top talkers, conversations, hostnames, anomalies.

  • wireshark_read_packets

    [DEPRECATED] JSON packet data. Use get_packet_list + get_packet_details instead.

  • wireshark_search_packets

    [Search] Find packets by content.

  • wireshark_set_protocol_prefs

    [Dissection] Protocol preference overrides. Prefs: 'tcp.desegment_tcp_streams:TRUE;http.ssl.port:8443'.

  • wireshark_stats_conversations

    [Conversations] Communication pairs and stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.

  • wireshark_stats_endpoints

    [Endpoints] List all endpoints and traffic stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.

  • wireshark_stats_expert_info

    [Expert Info] Automatic anomaly detection: retransmissions, errors, warnings, protocol issues.

  • wireshark_stats_io_graph

    [I/O Graph] Traffic volume by time bucket, optionally split by semicolon-separated display filters.

  • wireshark_stats_protocol_hierarchy

    [PHS] Protocol hierarchy statistics showing distribution of protocols in the capture.

  • wireshark_stats_service_response_time

    [SRT] Service response time statistics. protocol: 'http'|'dns'|'smb' etc.

  • wireshark_text2pcap_import

    Convert ASCII or hex dump into a capture file using text2pcap. encapsulation: link-layer type (default: ether).

Compare and alternatives

Featured in

Signals

Stars
352
Forks
43
Open issues
1
Weekly downloads
767
Last commit
Oct 23, 2026 (5 days ago)
Last release
Oct 18, 2026 (10 days ago)
Last package publish
Oct 18, 2026 (10 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.bx33661/wireshark-mcp
Version
0.6.5
Auth
No auth
Packages
pypi wireshark-mcp
License
MIT
Repository
github.com/bx33661/Wireshark-MCP
Website
github.com/bx33661/Wireshark-MCP
First seen
Oct 24, 2026
Last checked
Oct 25, 2026
Source
Official MCP Registrygithub-graphql
Cite this page

Wireshark MCP. Agent Mart. https://agentmart.dev/connectors/bx33661-wireshark-mcp (last updated 2026-10-25)