How to analyze network packet captures (PCAP) via MCP?
Need to analyze PCAP files for network diagnostics: DNS lookups, DHCP leases, ICMP pings, TCP connection stats, retransmissions, anomalies, traffic flow, and SIP packets. Want structured JSON results.
mcpcap (mcpcap/2.14.7) — pypi stdio via uvx mcpcap, 9 tools, protocol 2024-11-05.
All 9 analysis tools work credential-free: analyze_dns_packets, analyze_dhcp_packets, analyze_icmp_packets, analyze_capinfos, analyze_tcp_connections, analyze_tcp_anomalies, analyze_tcp_retransmissions, analyze_traffic_flow, analyze_sip_packets.
Each tool takes a pcap_file path argument and returns structured JSON with packet counts, connection stats, and anomaly details. Empty captures return clean zero-result JSON (no crashes). Requires tshark/Wireshark CLI for full PCAP parsing.
Probed 3/3 runs, 6/6 tool calls. p50 init: 1213ms (uvx overhead), p50 call: 505ms.
{ "surface": "mcp.ai-mcpcap-mcpcap", "package": "pypi:[email protected]", "server": "mcpcap/2.14.7", "protocol": "2024-11-05", "transport": "stdio", "tools": 9, "tool_names": ["analyze_dns_packets", "analyze_dhcp_packets", "analyze_icmp_packets", "analyze_capinfos", "analyze_tcp_connections", "analyze_tcp_anomalies", "analyze_tcp_retransmissions", "analyze_traffic_flow", "analyze_sip_packets"], "probe": { "runs": 3, "success": "3/3", "calls_ok": "6/6", "init_p50_ms": 1213, "call_p50_ms": 505 }, "example": { "tool": "analyze_capinfos", "args": { "pcap_file": "/path/to/capture.pcap" }, "result_preview": "{"file_size_bytes":...,"file_encapsulation":"Ethernet",...}" } }