mcpcap

mcpcap

A modular Python MCP (Model Context Protocol) Server for analyzing PCAP files.

10
Stars
5
Forks
20
Releases

Overview

mcpcap is a modular Python MCP server designed to analyze network PCAP captures using protocol-specific analysis tools. It provides stateless MCP analyses that accept PCAP file paths or HTTP(S) URLs as parameters, eliminating the need to upload files. The server's modular design includes DNS, DHCP, ICMP, and CapInfos analyses, with straightforward extensibility for new protocols. It leverages Scapy for robust packet parsing and returns results in JSON, optimized for consumption by MCP clients such as Claude Desktop. It supports both local and remote PCAP sources, with automatic temporary downloads and cleanup, and accepts common formats (.pcap, .pcapng, and .cap). The CLI allows selecting modules and configuring limits like max-packets. Public analysis tools include analyze_dns_packets, analyze_dhcp_packets, analyze_icmp_packets, and analyze_capinfos, each producing structured data such as DNS queries/responses, DHCP transactions and lease info, ICMP metrics, and file metadata. The architecture describes a flow from MCP Client Request to a structured JSON response, and notes future module expansions (e.g., HTTP, BGP, TLS). Remote file support is designed to operate securely over HTTPS when possible and to sanitize temporary files after analysis.

Details

Owner
mcpcap
Language
Python
License
MIT License
Updated
2025-12-07

Features

Stateless MCP Tools

Each analysis accepts PCAP file paths or URLs as parameters (no file uploads).

Modular Architecture

DNS, DHCP, ICMP, and CapInfos modules with easy extensibility for new protocols.

Local & Remote PCAP Support

Analyze files from local storage or HTTP URLs.

Scapy Integration

Leverages Scapy's comprehensive packet parsing capabilities.

Specialized Analysis Prompts

Security, networking, and forensic analysis guidance.

JSON Responses

Structured data format optimized for LLM consumption.

Client Integration Friendly

Designed for seamless integration with Claude Desktop and other MCP clients.

Remote File Handling

Automatic temporary download and cleanup; supports .pcap, .pcapng, and .cap; HTTP/HTTPS supported.

Audience

LLM developersIntegrate mcpcap into MCP clients to enable protocol-specific PCAP analysis via prompts.
Network security analystsUtilize mcpcap to analyze DNS, DHCP, ICMP, and CapInfos data for security insights.
Forensic investigatorsPerform protocol-specific PCAP analyses to aid timeline reconstruction and evidence gathering.

Tags

pcapnetwork-analysisdnsdhcpicmpcapinfosscapymcpserverstatelessremote-filesjsonforensicssecurity