mcpcap

Mcpcap MCP Server

mcpcap brings PCAP inspection into LLM workflows for network troubleshooting, security review, and forensic investigation. Its DNS, DHCP, ICMP, and capture-metadata tools analyze files by path or URL and return structured results.

Server facts

mcpcap MCP Server

Project

Author
mcpcap
License
Not specified

Tech

Runtime / language
Not specified
Transports
stdio
Remote available
No
Authentication
Not specified

Activity

GitHub stars
51
Last commit
Data as of

Tags

  • analysis
  • network
  • pcap

Overview

DNS lookups, DHCP leases, and ICMP exchanges are the main subjects of mcpcap's packet analysis. The DNS tool examines queried names, record types, and query frequency. DHCP analysis follows address allocation, client and server activity, lease details, and configuration options. ICMP analysis covers ping timing, traceroute-related data, connectivity problems, and error messages. A separate CapInfos tool reports capture metadata, including file size, packet counts, timestamps, duration, and traffic rates.

Users working in Claude Desktop or another MCP client supply an absolute local path or an HTTP/HTTPS URL rather than uploading a capture. The tools return JSON for LLM analysis, with prompts focused on troubleshooting, security review, and forensic work. Modules can be selected independently, and packet limits can constrain analysis of larger captures. Remote files are downloaded temporarily and cleaned up afterward; supported capture formats include .pcap, .pcapng, and .cap.

mcpcap setup notes

  • mcpcap records stdio only; confirm a network transport upstream before planning remote access.
  • mcpcap has no recorded license; confirm reuse terms in its repository.

Related MCP servers