WireMCP (Wireshark)

WireMCP is a network analysis server that empowers LLMs with real-time traffic monitoring capabilities by leveraging Wireshark's tshark utility. Developed by 0xKoda, it provides five specialized tools for capturing and analyzing network data: raw packet capture, protocol statistics, conversation tracking, and threat detection through URLhaus blacklist integration. The implementation automatically locates tshark across different operating systems, handles large packet captures by intelligently trimming output, and presents results in structured formats optimized for LLM comprehension. Ideal for security analysts using AI assistants for threat hunting, network diagnostics, and anomaly detection without requiring direct access to network monitoring tools.

Source

Repository: https://github.com/0xkoda/wiremcp