WireMCP
If you are the rightful owner of WireMCP and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
WireMCP is a Model Context Protocol server that enhances Large Language Models with real-time network traffic analysis capabilities using tools built on Wireshark's `tshark`.
WireMCP is a specialized server designed to provide Large Language Models (LLMs) with the ability to analyze real-time network traffic. By utilizing Wireshark's `tshark`, WireMCP captures live network data and processes it into structured formats that LLMs can understand and use. This server is particularly useful for tasks such as threat hunting, network diagnostics, and anomaly detection. WireMCP offers a suite of tools that allow LLMs to capture packets, summarize traffic statistics, track communication flows, and perform threat intelligence lookups. It also supports the analysis of PCAP files and the extraction of potential credentials, making it a valuable asset for security audits and forensic analysis. The server is compatible with any MCP-compliant client, providing flexibility and ease of integration across different platforms.
Features
- capture_packets: Captures live traffic and returns raw packet data as JSON for LLM analysis.
- get_summary_stats: Provides protocol hierarchy statistics to give an overview of traffic composition.
- get_conversations: Delivers TCP/UDP conversation statistics to track communication flows.
- check_threats: Checks captured IPs against the URLhaus blacklist for threat intelligence.
- analyze_pcap: Analyzes PCAP files to provide comprehensive packet data in JSON format.
