[Unofficial/Community] MCP server for Wireshark/tshark integration with AI tools
Listed on its own since 2026-09-24. Until then it was part of iflow-mcp-khuynh22-mcp-wireshark, where its earlier checks remain.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-wireshark","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-wireshark > Community-maintained MCP server for [Wireshark](https://www.wireshark.org/) / `tshark`. Not affiliated with Wireshark or Anthropic. > Give your AI assistant direct access to packet captures. Ask Claude to summarize a `.pcap`, follow a TCP stream, filter for a specific protocol, or capture live traffic — all without leaving the chat.  [](https://badge.fury.io/py/mcp-wireshark) [](https://github.com/khuynh22/mcp-wireshark/actions/workflows/ci.yml) [](https://opensource.org/licenses/MIT) [](https://www.python.org/downloads/) --- ## Quick start with Claude Code ```bash pip install mcp-wireshark claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark ``` That's it. Open Claude Code and try: > "Summarize ./capture.pcap and tell me which IPs talked the most." `--scope user` makes the server available across every Claude Code project. Drop the flag to install it for the current project only. See [`claude mcp` docs](https://code.claude.com/docs/en/mcp) for more. ### Verify the install ```bash claude mcp list ``` You should see `mcp-wireshark` listed. Inside Claude Code, ask: > "Run check_installation." If `tshark` is on your `PATH`, it returns the version. If not, see [troubleshooting](#troubleshooting). --- ## Tools The server exposes 14 tools, split cleanly between **read tools** (safe, no side effects) and **write tools** (capture traffic or write files). Both groups are annotated with the standard MCP `readOnlyHint` so any compliant client can surface the distinction. ### Read tools Safe to call freely — they only inspect state. | Tool | What it does …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.