Your LLM Can Now Sniff Packets with tshark

What it does

WireMCP wraps Wireshark’s tshark in a Model Context Protocol server, turning live packet captures and saved PCAP files into structured tools that any MCP client can invoke. It streams traffic as JSON, surfaces protocol statistics and conversation flows, and can even hunt for plaintext credentials from HTTP Basic Auth, FTP, or Telnet sessions. The goal is to spare your LLM from reading raw hex dumps by giving it pre-digested network context.

The interesting bit

Rather than dumping libpcap output into a prompt and hoping for the best, WireMCP uses tshark to pre-structure data—JSON summaries, threat lookups, credential scans—so the model reasons about traffic patterns instead of drowning in bytes. The extract_credentials tool is a blunt but effective security audit feature: essentially automated grep for bad hygiene, surfaced as a friendly LLM tool call.

Key highlights

• Live capture and PCAP analysis return structured JSON that LLMs can consume directly.
• Integrates threat intelligence lookups via URLhaus, with the roadmap noting plans for IPsum and Emerging Threats.
• extract_credentials scans capture files for HTTP Basic Auth, FTP, and Telnet credentials.
• Auto-detects tshark in PATH or falls back to common install locations, including macOS app bundles.
• Works with any MCP-compliant client; setup examples are shown for Cursor and Claude Desktop.

Caveats

• Threat intelligence is currently limited to URLhaus; additional feeds remain on the roadmap.
• Credential extraction only covers a handful of legacy plaintext protocols—modern encrypted traffic won’t yield secrets here.
• Live capture requires a local Wireshark/tshark installation; this won’t run in a sandboxed environment without those binaries.

Verdict

Useful if you want to bolt real-time network forensics onto an LLM assistant without writing a custom parser. Less useful if you need deep inspection without installing Wireshark, or if you require multi-source threat intelligence today.