AwesomeREA.org

Integration

WireMCP

Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. Three tools capture a few seconds of live traffic and return either a fixed set of IP, port, TCP-flag and HTTP fields, tshark's protocol-hierarchy statistics or TCP conversation statistics; analyze_pcap returns IPs, ports, HTTP URLs and protocol stacks from a saved capture. The remaining tools match captured IPs against the URLhaus blocklist and scan a capture for HTTP Basic, FTP, Telnet and Kerberos credentials, beside the dissection output.

Requirements & limits

  • Reviewed at main commit 7f45f8b from 2025-07-09, the last of nine commits since 2025-03-28; there are no releases or tags, package.json says 1.0.0 and its test script is a placeholder. It runs with Node.js (the README recommends v16+) after npm install, finds tshark on PATH or in common install locations, and is started by the MCP client as node index.js over stdio; the README lists macOS, Windows and Linux. Each tool also has a matching prompt template.
  • The live-capture tools default to interface en0 for 5 seconds and need capture permissions on the host; they write temp_capture.pcap in the working directory and delete it afterwards, and packet JSON is trimmed to about 720,000 characters. The server builds tshark shell commands by inserting the interface and file-path arguments without escaping, so it should be exposed only to trusted clients.
  • Field sets are fixed in the code: there is no arbitrary field extraction, display filter, decode-as or protocol-preference control, and the server does not infer unknown message formats. The separately listed Wireshark MCP exposes those dissector controls.
  • check_threats and check_ip_threats download the URLhaus text blocklist from abuse.ch and match IPs locally; although the README mentions multiple threat feeds, the reviewed code queries only URLhaus. The credential scan and threat checks are security heuristics rather than protocol reverse engineering, and their findings need analyst review.
  • MIT; Wireshark and tshark keep their own GPL terms. The reviewed sources establish no REA connection. No server, capture or analysis was run.

About this entry

Type
Integration
Category
Independent MCP integrations
Relationship
Independent agent integration
Targets
Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  2. index.js GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  3. index.js#L48-L180 GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  4. index.js#L182-L300 GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  5. index.js#L301-L364 GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  6. package.json GitHub · 0xKoda/WireMCP · Revision 7f45f8b
  7. LICENSE GitHub · 0xKoda/WireMCP · Revision 7f45f8b

More in Agents and MCP

All 46 entries in Agents and MCP