AwesomeREA.org

Integration

Wireshark MCP

MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. Separate security-heuristic, live-capture and capture-editing tools sit beside the dissection tools.

Requirements and limitations

  • Python 3.10+ and Wireshark with tshark on PATH; capinfos, mergecap, editcap, dumpcap and text2pcap are auto-detected optional extras, and live capture needs the platform's capture drivers and permissions. Install from PyPI (wireshark-mcp 3.1.0, built on MCP Python SDK 2.x) with its client installer, or through the Claude Code or Codex plugin route with uv. Reviewed at the v3.1.0 tag, released 2026-10-18 at the main head; the project changes quickly.
  • stdio is the default transport. SSE and streamable HTTP bind 127.0.0.1 by default and are unauthenticated, so the server refuses a non-loopback bind unless --allow-insecure-http is passed behind a trusted authenticated TLS proxy. The 11 file-writing tools (live capture, merge, filter-save, editcap, text2pcap, frame and object export) fail closed until WIRESHARK_MCP_ALLOWED_DIRS names existing directories; --profile analysis or core advertises fewer tools.
  • Protocol results come from Wireshark's existing dissectors and preset field lists; decode-as rules and preferences only redirect or configure those dissectors, and the server does not infer unknown message formats. Credential, scan, tunnelling, beaconing, exfiltration and YARA tools are security heuristics rather than protocol reverse engineering, and their findings need analyst review.
  • MIT; Wireshark and its tools keep their own GPL terms. REA's packet-capture guide documents a separate TShark workflow inside REA; this independent server establishes no REA connection. No server, capture or analysis was run.

About this entry

Type
Integration
Category
Independent MCP integrations
Relationship
Independent agent integration
Targets
Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
  2. src/wireshark_mcp/tools/advanced.py GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
  3. src/wireshark_mcp/server.py GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
  4. docs/security-hardening-v3.md GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
  5. pyproject.toml GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
  6. LICENSE GitHub · bx33661/Wireshark-MCP · Revision 0e1b659
  7. https://github.com/bx33661/Wireshark-MCP/releases/tag/v3.1.0
  8. https://pypi.org/project/wireshark-mcp/3.1.0/