The pairing is what makes it useful: capture on `en0`, then ask what looked wrong and get scans and odd DNS back rather than a pcap you still have to open. The catch is the privilege level — it needs root, and Claude Desktop cannot launch anything under sudo, so plan for a sudoers entry or a service account before you start.
A Go server that captures packets from a network interface and exposes them to an assistant, together with a threat-detection pass over what it captured. It reads TCP, UDP, DNS and HTTP/HTTPS traffic and flags patterns like port scanning or data exfiltration.
- `capture_start` begins capture on an interface, with a BPF filter if you want one
- `capture_stop` ends it
- `get_packets` retrieves and filters what was captured — DNS queries, traffic to a given port
- `analyze_traffic` returns statistics and connection patterns
- `get_suspicious` returns detected threats: port scans, malicious DNS queries, exfiltration patterns, anomalies
Go 1.21 or higher, libpcap development files, and root for capture — build with `go build -o network-monitor-mcp` and run it under sudo. No account and no key. Captured packets can contain anything crossing the interface, so treat the capture buffer as sensitive.