capture_packetsLABSCO SUMMARY
Pairing capture with a threat-intelligence lookup is what turns packets into a question you can answer.
Raw packet JSON is a lot of data and very little meaning; the useful move is always "which of these addresses is known bad". Doing the capture and the reputation check behind one connection means that question is one step rather than an export and a paste. Analysing a stored capture matters just as much — most real investigation happens after the fact, on a file someone hands you.
What it is
A wrapper around Wireshark's command-line tool that turns live and recorded network traffic into structured data a model can reason over.
What you get
- capture_packets — live traffic as raw packet data in JSON
- get_summary_stats — protocol hierarchy, so the composition of the traffic is visible at a glance
- get_conversations — TCP and UDP conversation statistics between endpoints
- check_threats — captured addresses checked against a public blocklist
- check_ip_threats — a targeted lookup for one address across several threat sources
- analyze_pcap — the same treatment for a stored capture file
Requirements
Wireshark's tshark installed and on PATH, plus Node. MIT licensed.
Setup effort
Build from source — clone the repository, then follow the project's own run instructions
USE CASES
01
Seeing what is on the wire now
Live capture returned as structured data.
02
Checking who is talking to whom
Conversation statistics between endpoints.
03
Spotting a known-bad address
Captured addresses checked against threat sources.
04
Investigating after the fact
The same analysis over a saved capture file.
7 tools
Listed in project docs. Your client may show a different list.
get_summary_statsget_conversationscheck_threatscheck_ip_threatsanalyze_pcapextract_credentialsBEFORE YOU INSTALL
What to know first
Tools you get
7 tools named in the project's documentation.
Requires
- node on PATH
- Node.js
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
node <YOUR_PATH_TO_WIRE_MCP>/index.jsMCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"wiremcp": {
"command": "node",
"args": [
"<YOUR_PATH_TO_WIRE_MCP>/index.js"
]
}
}
}
