mcpcap Documentation
A modular Python MCP (Model Context Protocol) server for analyzing PCAP files. mcpcap provides stateless analysis tools that accept a local file path or remote URL at call time, making it a good fit for Claude Desktop and other MCP clients.
Features
Stateless MCP Tools: Each analysis tool accepts PCAP file paths or URLs as parameters
Protocol Support: DNS, DHCP, ICMP, TCP, SIP, and CapInfos analysis
Local & Remote Files: Analyze files from local storage or HTTP URLs
Specialized Prompts: Security, networking, and forensic analysis guidance
Robust Analysis: Comprehensive packet parsing with error handling
Claude Desktop Ready: Perfect integration with MCP clients
Quick Start
Install mcpcap:
pip install mcpcap
Start the MCP server:
mcpcap
Or expose an HTTP MCP endpoint:
mcpcap --transport http --host 127.0.0.1 --port 8080
Then use analysis tools with any PCAP file:
analyze_dns_packets("/path/to/dns.pcap")
analyze_dhcp_packets("https://example.com/dhcp.pcap")
analyze_icmp_packets("/path/to/network.pcap")
analyze_tcp_connections("/path/to/tcp-session.pcap")
analyze_sip_packets("/path/to/voip-signaling.pcap")
analyze_capinfos("/path/to/capture.pcap")
API Reference
Developer Guide