How do I connect MCP Wireshark MCP Server to Claude?

The listing records `claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Desktop, Claude Code, Cursor as compatible clients.

Is MCP Wireshark MCP Server free?

The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.

What can MCP Wireshark MCP Server do?

MCP Wireshark MCP Server documents 14 tools to the agent, including analyze_iec61850, check_installation, decode_protocol. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.

MCP Wireshark

Unclaimed

by khuynh22

An MCP server that integrates Wireshark/tshark with AI tools and IDEs. Capture live traffic, parse .pcap files, apply display filters, follow streams, and export JSON - all via Claude Desktop, VS Code, or CLI. Cross‑platform, typed, tested, and pip‑installable.

Install

$claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

Set up this server

Compare servers My Stack

This server needs project-specific setup. Follow the project instructions; no reusable public launch command is available yet.

Project instructions

claude-aimcpmcp-servermodel-context-protocolnetwork-analysispacket-capturepcappythontsharkwireshark

Is this your MCP server?

This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.

Claim this server

Security profile

Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works

14 of 14 tools

Documented tools (14)

From project documentation. A server handshake does not verify each tool’s description or behavior.

analyze_iec61850

Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors

check_installation

Verify tshark is installed and show version

decode_protocol

Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol

display_filter

Apply a Wireshark display filter to a pcap

expert_info

tshark expert analysis: warnings, errors, and notes grouped by severity

export_json

Export packets from a pcap to a JSON file at a path you choose

follow_tcp

Reassemble a TCP stream and return its payload

follow_udp

Reassemble a UDP stream and return its payload

list_interfaces

List network interfaces available to capture from

live_capture

Capture live traffic from an interface (capped at 5 minutes / 10k packets)

protocol_stats

Aggregate -z reports (protocol hierarchy, conversations, endpoints, HTTP/DNS/SMB stats)

read_pcap

Read packets from a .pcap / .pcapng file (preview + total count)

stats_by_proto

Protocol hierarchy statistics

summarize_pcap

High-level summary: I/O stats, protocol hierarchy, top talkers

Tool change history

Compared across complete checks of the same configuration. Tools were listed, not invoked. Input-schema changes are not measured here.

No complete tool checks yet.

FAQ

Questions about MCP Wireshark MCP Server

How do I connect MCP Wireshark MCP Server to Claude?: The listing records `claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Desktop, Claude Code, Cursor as compatible clients.
Is MCP Wireshark MCP Server free?: The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
What can MCP Wireshark MCP Server do?: MCP Wireshark MCP Server documents 14 tools to the agent, including analyze_iec61850, check_installation, decode_protocol. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.