mcpcap
The mcpcap MCP server parses PCAP files for DNS, DHCP, ICMP, TCP and SIP and hands the agent structured JSON for network diagnostics
- 54 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The server reads local files by the given path and downloads captures from arbitrary URLs
- Captures can hold internal addresses and credentials that end up in the model context
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/mcpcapDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reads local files by the given path and downloads captures from arbitrary URLs
- Captures can hold internal addresses and credentials that end up in the model context
This is third-party code. Review the repository files before installing.
What it does
mcpcap is a Python server built on FastMCP and scapy. Each call gets a local file path or an HTTP URL of the capture, so the server keeps no state between requests. It reads .pcap, .pcapng and .cap files, and a remote file is downloaded to a temporary folder and removed after analysis. Analysis is split into protocol modules. The DNS module extracts queries and responses, record types and query frequency. The DHCP module follows the DISCOVER, OFFER, REQUEST and ACK exchange and the leases handed out. The ICMP module measures ping response time, the TCP module covers connection lifecycle, retransmissions and anomalies, and analyze_traffic_flow shows flows between hosts. The SIP module reads call signaling by Call-ID and CSeq, and capinfos prints general file details. The tools come with agent prompts for security, troubleshooting and forensics, such as tcp_security_analysis and dhcp_forensic_investigation. A run is narrowed with the `--modules` and `--max-packets` flags.
Who it is for. Network engineers and administrators who go through traffic captures with Claude Desktop or Claude Code and prefer not to read packets by hand.
Good fit when
- SIP calls drop and you need to find the response where call setup breaks
- A service is slow and TCP retransmissions are the suspect
- A client gets no DHCP lease and the capture shows only part of the exchange
- The capture came as a link and you would rather not download it by hand
- You want a quick summary of a file: size, protocols, time range
Not a fit when
- You need live capture: the server reads finished files and does not sniff packets itself
- The protocol is outside DNS, DHCP, ICMP, TCP and SIP: HTTP, TLS and BGP are planned, with no modules yet
- The capture holds sensitive data and the agent runs on an external model
- You want to process a huge file in full: without `--max-packets` the analysis is unbounded
Example request
Analyze /captures/call.pcap: find which SIP response breaks call setup and show the Call-IDs of the failing dialogs.MCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
MCPCAP_AUTH_TOKENsecret- Secret for HTTP mode on a non-loopback interface; the client sends it in the Authorization header.
Limitations
Python 3.10 or newer is required. The server reads finished captures and does not sniff traffic.
HTTP mode on a non-loopback interface needs a token in the MCPCAP_AUTH_TOKEN variable, and the client sends it in the Authorization header. The `--allow-unauthenticated-http` flag drops the token and is meant for isolated runs, such as Docker with a loopback-published port.
Captures often hold internal addresses and credentials. Take remote captures from trusted sources only.
How to disable. Remove the mcpcap entry from the MCP client config. The package is removed with `pip uninstall mcpcap`, and a Docker container is stopped the usual way.
FAQ
Which protocols does mcpcap analyze?
DNS, DHCP, ICMP, TCP and SIP, plus a general file summary through capinfos. TCP has separate tools for connections, anomalies, retransmissions and traffic flows. The module list is narrowed with `--modules`.
Can I pass a file by link?
Yes. A tool accepts an HTTP or HTTPS URL of the capture, downloads it to a temporary file and removes it after analysis. A local path works too, and in Docker you use the path inside the container, such as /pcaps/dns.pcap.
How do I connect mcpcap to Claude Desktop?
Install the package and add a server with command mcpcap to claude_desktop_config.json. The default transport is stdio, so nothing else has to run. For clients that need a network address there is `mcpcap --transport http`, listening on 127.0.0.1:8080/mcp.
Is HTTP mode protected?
On loopback it runs without a token. Bound to another interface, the server requires a secret in MCPCAP_AUTH_TOKEN and checks it on every request, and a TLS proxy is advised for outside access.
What should I do with a large capture?
Limit the analysis with the `--max-packets` flag, for example `mcpcap --max-packets 1000`, and enable only the modules you need through `--modules`. By default the packet count is unlimited.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server for Cisco Packet Tracer: an agent plans a network, builds it on the canvas and proves connectivity with ping.
During a network incident, an agent retrieves the route to a service while the administrator controls diagnostic access.
An MCP server built into the Netdata agent: metrics, logs, alerts and live process, service and container data for an AI assistant
An MCP server for MikroTik routers: the agent reads and changes RouterOS configuration over SSH on a chat request
mcpd starts MCP servers from one .mcpd.toml file and serves them to agents and scripts as a plain HTTP API on a local port
An agent runs servers through a catalog of declared actions: policy decides what runs and what waits for a person
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| mcpcap (this card) | yes | not required | 54 | |
| Kubeshark | yes | not required | 12,131 | capture and inspection of live Kubernetes traffic |
| Network Sketcher Local MCP | yes | not required | 417 | draws network diagrams, while mcpcap reads traffic captures |
README in short
The docs describe a modular design: a shared base class handles file reading and download, and protocol modules add their own tools. A new protocol is added by subclassing BaseModule. The repository carries sample dns.pcap and dhcp.pcap files for testing, with no ICMP sample.