Awesome MCP › Security & Reverse Engineering

0xKoda/WireMCP

⭐ 583 JavaScript added to this list on 2025-04-09 repository created 2025-03-28

WireMCP is a Model Context Protocol (MCP) server designed to enhance Large Language Models (LLMs) with real-time network traffic analysis capabilities. It leverages Wireshark's tshark tool to capture and process live network data, providing structured context that aids in threat detection, network diagnostics, and anomaly identification. WireMCP offers several tools accessible to MCP clients, including capturing live packets and returning raw packet data in JSON format, summarizing protocol hierarchy statistics, delivering TCP/UDP conversation statistics, and checking IP addresses against threat intelligence sources like the URLhaus blacklist. It also supports detailed analysis of PCAP files and extraction of potential credentials from network traffic, which is useful for security audits and forensic investigations. By converting raw network data into structured outputs, WireMCP enables LLMs to better understand and reason about network activity, facilitating tasks such as threat hunting, troubleshooting, and generating human-readable narratives from complex packet captures. The project supports multiple platforms including Mac, Windows, and Linux, requiring Wireshark with tshark, Node.js, and npm for setup. WireMCP is compatible with any MCP-compliant client and provides example configurations for popular clients like Cursor. The project roadmap includes plans to expand threat intelligence sources beyond URLhaus to enhance coverage. WireMCP is open for contributions and is licensed under MIT. It acknowledges the Wireshark/tshark team, the MCP community, and URLhaus for their respective contributions. Overall, WireMCP bridges the gap between raw network traffic data and LLM comprehension, empowering AI-driven network security and diagnostics.

https://github.com/0xKoda/WireMCP

analyze_pcapanomaly-detectionanomaly-identificationcapture_packetscheck_ip_threatscheck_threatscredential-extractiondiagnosticsextract_credentialsforensic-analysisget_conversationsget_summary_statsjsonlarge-language-modelsllmmcpmcp-servermodel-context-protocolnetwork-analysisnetwork-diagnosticsnetwork-securitynetwork-traffic-analysispacket-capturepcappcap-analysisreal-time-analysisreal-time-datasecurity-auditstcp/udp-conversationsthreat-detectionthreat-huntingthreat-intelligencetsharkurlhauswireshark