What is Wiremcp

WireMCP is a Model Context Protocol (MCP) server that enhances Large Language Models (LLMs) with real-time network traffic analysis capabilities, utilizing tools based on Wireshark’s tshark to capture and process live network data.

Use cases

Use cases for WireMCP include detecting malicious activities through threat intelligence, troubleshooting network issues by analyzing traffic patterns, and generating narratives from complex packet data for easier understanding by non-technical users.

How to use

To use WireMCP, clients can connect to the MCP server and utilize its exposed tools such as capture_packets, get_summary_stats, get_conversations, check_threats, and check_ip_threats to analyze network traffic and gather insights.

Key features

Key features of WireMCP include live packet capture in JSON format, protocol hierarchy statistics, TCP/UDP conversation tracking, threat intelligence integration against blacklists, and detailed reputation checks for specific IP addresses.

Where to use

WireMCP is applicable in fields such as cybersecurity, network diagnostics, threat hunting, and any domain requiring real-time analysis of network traffic for enhanced decision-making.

WireMCP

WireMCP is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with real-time network traffic analysis capabilities. By leveraging tools built on top of Wireshark’s tshark, WireMCP captures and processes live network data, providing LLMs with structured context to assist in tasks like threat hunting, network diagnostics, and anomaly detection.

Features

WireMCP exposes the following tools to MCP clients, enhancing LLM understanding of network activity:

• capture_packets: Captures live traffic and returns raw packet data as JSON, enabling LLMs to analyze packet-level details (e.g., IP addresses, ports, HTTP methods).
• get_summary_stats: Provides protocol hierarchy statistics, giving LLMs an overview of traffic composition (e.g., TCP vs. UDP usage).
• get_conversations: Delivers TCP/UDP conversation statistics, allowing LLMs to track communication flows between endpoints.
• check_threats: Captures IPs and checks them against the URLhaus blacklist, equipping LLMs with threat intelligence context for identifying malicious activity.
• check_ip_threats: Performs targeted threat intelligence lookups for specific IP addresses against multiple threat feeds, providing detailed reputation and threat data.
• analyze_pcap: Analyzes PCAP files to provide comprehensive packet data in JSON format, enabling detailed post-capture analysis of network traffic.
• extract_credentials: Scans PCAP files for potential credentials from various protocols (HTTP Basic Auth, FTP, Telnet), aiding in security audits and forensic analysis.

How It Helps LLMs

WireMCP bridges the gap between raw network data and LLM comprehension by:

• Contextualizing Traffic: Converts live packet captures into structured outputs (JSON, stats) that LLMs can parse and reason about.
• Threat Detection: Integrates IOCs (currently URLhaus) to flag suspicious IPs, enhancing LLM-driven security analysis.
• Diagnostics: Offers detailed traffic insights, enabling LLMs to assist with troubleshooting or identifying anomalies.
• Narrative Generation: LLM’s can Transform complex packet captures into coherent stories, making network analysis accessible to non-technical users.

Installation

Prerequisites

• Mac / Windows / Linux
• Wireshark (with tshark installed and accessible in PATH)
• Node.js (v16+ recommended)
• npm (for dependency installation)

Setup

1. Clone the repository:

   git clone https://github.com/0xkoda/WireMCP.git
   cd WireMCP
   

2. Install dependencies:

   npm install
   

3. Run the MCP server:

   node index.js
   

Note: Ensure tshark is in your PATH. WireMCP will auto-detect it or fall back to common install locations (e.g., /Applications/Wireshark.app/Contents/MacOS/tshark on macOS).

Usage with MCP Clients

WireMCP works with any MCP-compliant client. Below are examples for popular clients:

Example 1: Cursor

Edit mcp.json in Cursor -> Settings -> MCP :

{
  "mcpServers": {
    "wiremcp": {
      "command": "node",
      "args": [
        "/ABSOLUTE_PATH_TO/WireMCP/index.js"
      ]
    }
  }
}

Location (macOS): /Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json

Other Clients

This MCP will work well with any client. Use the command node /path/to/WireMCP/index.js in their MCP server settings.

Example Output

Running check_threats might yield:

Captured IPs:
174.67.0.227
52.196.136.253

Threat check against URLhaus blacklist:
No threats detected in URLhaus blacklist.

Running analyze_pcap on a capture file:

{
  "content": [
    {
      "type": "text",
      "text": "Analyzed PCAP: ./capture.pcap\n\nUnique IPs:\n192.168.0.2\n192.168.0.1\n\nProtocols:\neth:ethertype:ip:tcp\neth:ethertype:ip:tcp:telnet\n\nPacket Data:\n[{\"layers\":{\"frame.number\":[\"1\"],\"ip.src\":[\"192.168.0.2\"],\"ip.dst\":[\"192.168.0.1\"],\"tcp.srcport\":[\"1550\"],\"tcp.dstport\":[\"23\"]}}]"
    }
  ]
}

LLMs can use these outputs to:

• Provide natural language explanations of network activity
• Identify patterns and potential security concerns
• Offer context-aware recommendations
• Generate human-readable reports

Roadmap

• Expand IOC Providers: Currently uses URLhaus for threat checks. Future updates will integrate additional sources (e.g., IPsum, Emerging Threats) for broader coverage.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

License

MIT

Acknowledgments

• Wireshark/tshark team for their excellent packet analysis tools
• Model Context Protocol community for the framework and specifications
• URLhaus for providing threat intelligence data