wireshark-mcp — Claude Code MCP server: what it does, how to install
Connects tshark to your assistant for deep packet capture examination. Ask questions about .pcap files and detect anomalies without leaving chat.
claude mcp add wireshark-mcp -- uvx wireshark-mcpWhat wireshark-mcp does
This server introduces 54 analysis tools on top of command-line tshark. An assistant can inspect raw packets, track conversations, check credential leaks, and flag DNS tunneling. A single protocol dispatcher automatically maps query filters across 25 protocols like MQTT and TLS, avoiding syntax guessing mistakes.
System dependencies are strict. You must have Python 3.10 or newer, alongside Wireshark with tshark configured inside your system PATH. Auxiliary binaries such as editcap or dumpcap are recognized automatically when present. Without an installed Wireshark binary, the server cannot execute any inspections.
The default tool definitions add around 23 KB to every model request prompt. If this context footprint feels heavy, selecting alternative profiles limits the exposed surface.
What it helps with
- investigate suspicious DNS queries and potential data tunnels
- inspect HTTP payloads and extract captured artifacts
- spot port scans and plaintext credential transfers
- generate traffic summaries and endpoint communication graphs
Example prompts for the agent
- Inspect
dump.pcapusingwireshark_open_fileand highlight abnormal flows - Extract all DNS requests from the capture and check for tunneling
- Summarize conversation endpoints and check for plaintext passwords
How to install wireshark-mcp
Platform CLI
claude mcp add wireshark-mcp -- uvx wireshark-mcpuvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>
Platform CLI
codex mcp add wireshark-mcp -- uvx wireshark-mcpuvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>
Config file
{
"mcpServers": {
"wireshark-mcp": {
"command": "uvx",
"args": [
"wireshark-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>
Config file
{
"servers": {
"wireshark-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"wireshark-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>
Platform CLI
gemini mcp add wireshark-mcp uvx wireshark-mcpuvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about wireshark-mcp
How to install wireshark-mcp in Claude Code?
Run claude mcp add wireshark-mcp -- uvx wireshark-mcp in your terminal. You must have uv installed beforehand.
What does wireshark-mcp do?
It bridges your coding assistant to the tshark engine for automated network forensics. The assistant parses packet traces, tracks sessions, and inspects protocol fields via chat prompts.
Does this MCP server package Wireshark itself?
No, it does not supply Wireshark or capture drivers. You need an existing installation of Wireshark with tshark accessible in your environment PATH.
