WireMCP

WireMCP requires Wireshark (with tshark in your PATH) and Node.js (v16+).

To install and run the server locally:

1. Clone the repository and enter the directory.
2. Install dependencies using npm.
3. Start the server using node index.js.

Prerequisites:

• Mac / Windows / Linux
• Wireshark (ensure tshark is accessible in your PATH)
• Node.js (v16+ recommended)
• npm

git clone https://github.com/0xkoda/WireMCP.git
cd WireMCP
npm install
node index.js

To use WireMCP with the Cursor editor, add the server configuration to your mcp.json settings. You must provide the absolute path to the index.js file within the WireMCP directory.

{
  "mcpServers": {
    "wiremcp": {
      "command": "node",
      "args": [
        "/ABSOLUTE_PATH_TO/WireMCP/index.js"
      ]
    }
  }
}

WireMCP provides pre-configured prompts to help LLMs perform specific security and network analysis tasks. These prompts structure the user's request to ensure the LLM looks for specific indicators like protocol distribution, unusual patterns, or credential exposure.

Available prompts:

• capture_packets_prompt
• summary_stats_prompt
• conversations_prompt
• check_threats_prompt
• check_ip_threats_prompt
• analyze_pcap_prompt
• extract_credentials_prompt

When running analyze_pcap on a capture file, the tool returns a structured JSON object containing unique IPs, protocol hierarchies, and detailed packet layer data.

{
  "content": [{
    "type": "text",
    "text": "Analyzed PCAP: ./capture.pcap\n\nUnique IPs:\n192.168.0.2\n192.168.0.1\n\nProtocols:\neth:ethertype:ip:tcp\neth:ethertype:ip:tcp:telnet\n\nPacket Data:\n[{\"layers\":{\"frame.number\":[\"1\"],\"ip.src\":[\"192.168.0.2\"],\"ip.dst\":[\"192.168.0.1\"],\"tcp.srcport\":[\"1550\"],\"tcp.dstport\":[\"23\"]}}]"
  }]
}

WireMCP exposes several tools to MCP clients to enable real-time network traffic analysis and threat intelligence:

• capture_packets: Captures live traffic and returns raw packet data as JSON (IPs, ports, HTTP methods, etc.).
• get_summary_stats: Provides protocol hierarchy statistics (e.g., TCP vs. UDP usage).
• get_conversations: Provides TCP/UDP conversation statistics to track communication flows.
• check_threats: Captures live IPs and checks them against the URLhaus blacklist.
• check_ip_threats: Performs targeted threat intelligence lookups for specific IP addresses against multiple feeds.
• analyze_pcap: Analyzes PCAP files and returns comprehensive packet data in JSON format.
• extract_credentials: Scans PCAP files for potential credentials in protocols like HTTP Basic Auth, FTP, and Telnet.

Captures live network traffic for a specified duration and returns raw packet data as JSON. This is useful for deep inspection of specific packet fields like IP addresses, ports, TCP flags, and HTTP methods. The output is automatically trimmed to fit within a 720,000 character limit to ensure compatibility with LLM context windows.

// Example tool call arguments
{
  "interface": "en0",
  "duration": 10
}

Performs a targeted lookup of a single IP address against the URLhaus blacklist to determine if it is a known indicator of compromise (IOC).

// Example tool call arguments
{
  "ip": "1.2.3.4"
}

Scans a PCAP file for sensitive information, including:

• Plaintext Credentials: HTTP Basic Auth, FTP (USER/PASS), and Telnet prompts.
• Encrypted/Hashed Credentials: Kerberos authentication attempts (AS-REQ, TGS-REQ, AS-REP).

For Kerberos hashes, the tool provides the specific hashcat or John the Ripper commands required for cracking.

// Example tool call arguments
{
  "pcapPath": "./capture.pcap"
}

Captures live traffic and provides statistics on active TCP and UDP conversations. This is useful for identifying the most active IP pairs and communication patterns.

// Example tool call arguments
{
  "interface": "en0",
  "duration": 5
}

Captures live traffic and returns a summary of the protocol hierarchy (e.g., distribution of protocols like TCP, UDP, HTTP). This helps in understanding the high-level composition of network traffic.

// Example tool call arguments
{
  "interface": "eth0",
  "duration": 5
}

Analyzes a pre-recorded PCAP file. It extracts unique IPs, discovered URLs, and protocols, and provides the full packet data in JSON format for detailed LLM analysis.

// Example tool call arguments
{
  "pcapPath": "./network_dump.pcap"
}

Captures live traffic on a specified interface, extracts all unique IP addresses, and checks them against the URLhaus blacklist to identify potential malicious activity.

// Example tool call arguments
{
  "interface": "en0",
  "duration": 5
}