M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
M

MCPCap

Community
Network analysis for the AI age
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #199 of 438
Stars
★ 51 Popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Python 3.10+ · Docker
Credentials
No credential needed
License
MIT
Last commit
Tools
9
54FMRS · D

mcpcap is a comprehensive MCP server for PCAP analysis, offering a wide range of protocol-specific tools, support for local and remote files, and a modular architecture that is easy to extend. It is well-suited for network analysts, security researchers, and AI integration developers.

Strongest · Setup experience 12/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
12/20
Maintenance
10/20
Documentation
12/20
Setup experience
12/20
Why each score
Reliability 8/20
Evidence: README describes a FastMCP-based server with stdio and HTTP transports, stateless per-call PCAP path/URL analysis tools, and a clear tool flow. The PyPI package identifier in the manifest matches the pip/uv install instructions. Deductions: static review only; no CI workflows, committed tests, or reproducible startup evidence; error handling, very large file behavior, and module-load failure diagnosability are unverified.
Security and permissions 12/20
Evidence: Stateless design; each call supplies the PCAP path/URL; remote downloads are HTTPS and temp files are cleaned up; no credentials, secrets, destructive operations, or remote-command defaults; tools only read and analyze. Deductions: clients can trigger arbitrary local file reads and arbitrary HTTP(S) URL downloads without confirmation, input validation/hardening of remote content is limited, and the file-read boundary is not explicitly handled in server code. No red-line issues found.
Maintenance 10/20
Evidence: Repository is not archived, has an MIT license, a released PyPI package (declared, not verified), ongoing development evidenced by a recent version in the README, plus security notes and contribution guidance. Deductions: no verifiable commit history/release timeline, dependency update records, security-response channel, maintainer identity, or issue-response evidence.
Documentation 12/20
Evidence: README is broad: install via pip/uv/uvx/Docker/Compose, client configs for stdio and HTTP, per-tool descriptions for every module, CLI reference, examples, MCP Inspector usage, and security notes. Deductions: no auth, cost, rate-limit, or detailed troubleshooting sections; architecture, Compose, and docs-site links are README claims only; remote limitations and format support are asserted, not evidenced.
Setup experience 12/20
Evidence: Clear install paths (pip, uv, uvx, Docker, Compose), stdio and HTTP client config examples, Docker bind-mount guidance, and a complete CLI reference. Deductions: no executable CI/test evidence validating the install paths; Python dependencies are listed in README but not locked in the manifest; Docker/Compose files were not provided; config examples live at README level rather than in testable config files.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesUses the network

Best for

  • AI assistants or automation tools needing quick PCAP analysis.
  • Developers integrating network analysis into MCP clients like Claude Desktop.
  • Scenarios requiring stateless, modular, and extensible PCAP analysis.

Not for

  • Handling extremely large PCAP files without performance tuning (no packet limits by default).
  • Real-time network capture; mcpcap only analyzes existing PCAP files.
  • Users needing deep interactive analysis with a GUI (e.g., as a Wireshark replacement).

Required permissions

  • Read access to local PCAP files provided by the user.
  • Ability to download remote PCAP files over HTTP/HTTPS.
  • Create temporary files for remote downloads and automatic cleanup.

Risks and side effects

  • PCAP files may contain sensitive network information; handle with care.
  • Remote PCAP files may be malicious; verify source trustworthiness.
  • Large files may consume significant memory and CPU during analysis.

Setup

Before you start

Runtime：Python 3.10+ · Docker

Install via pip: pip install mcpcap; or via uv: uv add mcpcap. For Docker, build the image from the repository root: docker build -t mcpcap ., then run with stdio or HTTP transport. You can also use Docker Compose with docker compose up.

claude_desktop_config.json 
{
  "mcpServers": {
    "mcpcap": {
      "command": "mcpcap",
      "args": []
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "mcpcap": {
      "command": "mcpcap",
      "args": []
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add mcpcap -- mcpcap

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After adding the mcpcap server to your client config, the tool list should show the nine analyze_* tools; calling analyze_dns_packets("./examples/dns.pcap") and getting a structured DNS report confirms the connection works.

Troubleshooting

  1. Ensure Python version >= 3.10.
  2. If using Docker, ensure the volume mount is correct and use in-container paths (e.g., `/pcaps/dns.pcap`).
  3. Check network connectivity and URL validity for remote files.
  4. Verify the PCAP file format is supported (.pcap, .pcapng, .cap).

Things to try

Once connected, you can ask your AI assistant things like:

  • Analyze the DNS traffic in my local capture /path/to/dns.pcap
  • Use analyze_tcp_connections to check connections to 192.168.1.1:80 in this PCAP
  • Analyze the SIP signaling in https://example.com/remote.pcap
  • Give me summary statistics for this capture file with analyze_capinfos

Tools 9

analyze_dns_packets read-only
Analyze DNS traffic: extract queries, responses, domains, types, frequencies, and potential security issues.
analyze_dhcp_packets read-only
Analyze DHCP traffic: track transactions, clients/servers, IP assignments, and anomalies.
analyze_icmp_packets read-only
Analyze ICMP traffic: ping response times, TTLs, error messages, and potential attacks.
analyze_tcp_connections read-only
Analyze TCP connection states: three-way handshake, lifecycle, termination, and filtering by server IP/port.
analyze_tcp_anomalies read-only
Observational TCP analysis: summarize handshakes, flags, resets, and retransmissions.
analyze_tcp_retransmissions read-only
Measure overall and per-connection retransmission rates to detect congestion and packet loss.
analyze_traffic_flow read-only
Analyze bidirectional traffic flow, identify asymmetry, and determine RST packet sources.
analyze_sip_packets read-only
Parse SIP signaling: extract call IDs, CSeq values, endpoints, and method summaries.
Show 1 more tools
analyze_capinfos read-only
Extract PCAP metadata and statistics: file size, packet count, duration, throughput, similar to capinfos.

Use cases

Network troubleshooting: analyze TCP connections, retransmissions, and traffic flow to identify issues.
Security analysis: detect DNS tunneling, ICMP reconnaissance, DHCP anomalies, and other threats.
Forensic investigation: reconstruct network timelines and collect evidence.
SIP/VoIP troubleshooting: analyze SIP signaling to diagnose call setup failures.

Supported clients

Claude Desktop

Listed from the project's documentation, not tested by this site.

Overview

mcpcap is a modular Python MCP server for analyzing PCAP files. It exposes protocol-specific analysis tools (DNS, DHCP, ICMP, TCP, SIP, etc.) that accept a local file path or remote HTTP URL at call time. The server is stateless and works with MCP clients like Claude Desktop.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 0b7af6b29f25 Data synced 2026-10-13 Read the FMRS scoring method