Best for
- AI assistants or automation tools needing quick PCAP analysis.
- Developers integrating network analysis into MCP clients like Claude Desktop.
- Scenarios requiring stateless, modular, and extensible PCAP analysis.
M
54FMRS · D
mcpcap is a comprehensive MCP server for PCAP analysis, offering a wide range of protocol-specific tools, support for local and remote files, and a modular architecture that is easy to extend. It is well-suited for network analysts, security researchers, and AI integration developers.
mcpcap is a modular Python MCP server for analyzing PCAP files. It exposes protocol-specific analysis tools (DNS, DHCP, ICMP, TCP, SIP, etc.) that accept a local file path or remote HTTP URL at call time. The server is stateless and works with MCP clients like Claude Desktop.
Tools
analyze_dns_packets
Analyze DNS traffic: extract queries, responses, domains, types, frequencies, and potential security issues.
analyze_dhcp_packets
Analyze DHCP traffic: track transactions, clients/servers, IP assignments, and anomalies.
analyze_icmp_packets
Analyze ICMP traffic: ping response times, TTLs, error messages, and potential attacks.
analyze_tcp_connections
Analyze TCP connection states: three-way handshake, lifecycle, termination, and filtering by server IP/port.
analyze_tcp_anomalies
Observational TCP analysis: summarize handshakes, flags, resets, and retransmissions.
analyze_tcp_retransmissions
Measure overall and per-connection retransmission rates to detect congestion and packet loss.
analyze_traffic_flow
Analyze bidirectional traffic flow, identify asymmetry, and determine RST packet sources.
analyze_sip_packets
Parse SIP signaling: extract call IDs, CSeq values, endpoints, and method summaries.
analyze_capinfos
Extract PCAP metadata and statistics: file size, packet count, duration, throughput, similar to capinfos.
Setup
Install via pip: pip install mcpcap; or via uv: uv add mcpcap. For Docker, build the image from the repository root: docker build -t mcpcap ., then run with stdio or HTTP transport. You can also use Docker Compose with docker compose up.
claude_desktop_config.json
{
"mcpServers": {
"mcpcap": {
"command": "mcpcap",
"args": []
}
}
}
Fit and risk
Not for
- Handling extremely large PCAP files without performance tuning (no packet limits by default).
- Real-time network capture; mcpcap only analyzes existing PCAP files.
- Users needing deep interactive analysis with a GUI (e.g., as a Wireshark replacement).
Required permissions
- Read access to local PCAP files provided by the user.
- Ability to download remote PCAP files over HTTP/HTTPS.
- Create temporary files for remote downloads and automatic cleanup.
Risks and side effects
- PCAP files may contain sensitive network information; handle with care.
- Remote PCAP files may be malicious; verify source trustworthiness.
- Large files may consume significant memory and CPU during analysis.
Troubleshooting
- Ensure Python version >= 3.10.
- If using Docker, ensure the volume mount is correct and use in-container paths (e.g., `/pcaps/dns.pcap`).
- Check network connectivity and URL validity for remote files.
- Verify the PCAP file format is supported (.pcap, .pcapng, .cap).
Use cases
Network troubleshooting: analyze TCP connections, retransmissions, and traffic flow to identify issues.
Security analysis: detect DNS tunneling, ICMP reconnaissance, DHCP anomalies, and other threats.
Forensic investigation: reconstruct network timelines and collect evidence.
SIP/VoIP troubleshooting: analyze SIP signaling to diagnose call setup failures.
Supported clients
Claude DesktopFull support