capture_startLABSCO SUMMARY
Packet capture and the read of it in the same conversation.
The pairing is what makes it useful: capture on en0, then ask what looked wrong and get scans and odd DNS back rather than a pcap you still have to open. The catch is the privilege level — it needs root, and Claude Desktop cannot launch anything under sudo, so plan for a sudoers entry or a service account before you start.
What it is
A Go server that captures packets from a network interface and exposes them to an assistant, together with a threat-detection pass over what it captured. It reads TCP, UDP, DNS and HTTP/HTTPS traffic and flags patterns like port scanning or data exfiltration.
What you get
capture_startbegins capture on an interface, with a BPF filter if you want onecapture_stopends itget_packetsretrieves and filters what was captured — DNS queries, traffic to a given portanalyze_trafficreturns statistics and connection patternsget_suspiciousreturns detected threats: port scans, malicious DNS queries, exfiltration patterns, anomalies
Requirements
Go 1.21 or higher, libpcap development files, and root for capture — build with go build -o network-monitor-mcp and run it under sudo. No account and no key. Captured packets can contain anything crossing the interface, so treat the capture buffer as sensitive.
Setup effort
Follow the published steps — brew install libpcap
USE CASES
01
Working out what a machine is talking to
Capture on the active interface, then ask for the DNS queries and the connection patterns.
02
Checking a network you own for scanning activity
Run a capture and read back detected port scans and anomalies instead of grepping a dump.
03
Narrowing a capture to one problem
Start with a BPF filter for the traffic you care about, then pull only the matching packets.
5 tools
Listed in project docs. Your client may show a different list.
capture_stopget_packetsanalyze_trafficget_suspiciousBEFORE YOU INSTALL
What to know first
Tools you get
5 tools named in the project's documentation.
Requires
Go 1.21 or later
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
Install libpcap — macOS
TERMINAL
brew install libpcapInstall libpcap — Ubuntu/Debian
TERMINAL
sudo apt-get install libpcap-devInstall libpcap — RHEL/CentOS
TERMINAL
sudo yum install libpcap-develClone the repository
TERMINAL
git clone https://github.com/skapa-xyz/network-monitor-mcp.git
cd network-monitor-mcpInstall dependencies
TERMINAL
go mod downloadBuild the server
TERMINAL
go build -o network-monitor-mcpRunning the MCP Server (requires root privileges for packet capture)
TERMINAL
sudo ./network-monitor-mcpMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"network-monitor": {
"command": "<YOUR_PATH_TO_NETWORK_MONITOR_MCP>"
}
}
}Claude Desktop cannot run commands with sudo. The project's Option 1 is a sudoers entry that lets the binary run without a password (username ALL=(ALL) NOPASSWD: <YOUR_PATH_TO_NETWORK_MONITOR_MCP>), which it warns grants passwordless root to the binary and should only be used in isolated development environments.
