tshark-mcp

Local install

io.github.Kx96xx/tshark-mcpv0.2.0 GitHub verified

Read-only packet capture analysis with tshark: Diameter, GTP, SIP, RTP, SIGTRAN, DNS, TCP and TLS.

Security

Watch Source Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-05T07:17:54.228684Z",
      "publishedAt": "2026-11-05T07:17:54.228684Z",
      "statusChangedAt": "2026-11-05T07:17:54.228684Z"
    }
  },
  "server": {
    "name": "io.github.Kx96xx/tshark-mcp",
    "title": "tshark-mcp",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.2.0",
    "packages": [
      {
        "version": "0.2.0",
        "transport": {
          "type": "stdio"
        },
        "identifier": "tshark-mcp-server",
        "runtimeHint": "uvx",
        "registryType": "pypi",
        "registryBaseUrl": "https://pypi.org",
        "environmentVariables": [
          {
            "name": "TSHARK_MCP_ALLOW_DIRS",
            "format": "string",
            "isRequired": true,
            "description": "Directories the server may read captures from, colon-separated. Required: the server refuses to start without one.",
            "placeholder": "/path/to/pcaps"
          },
          {
            "name": "TSHARK_MCP_TSHARK",
            "format": "filepath",
            "description": "Path to the tshark binary (4.0 or newer) when it is not on PATH."
          },
          {
            "name": "TSHARK_MCP_REDACT",
            "format": "string",
            "choices": [
              "off",
              "ids",
              "ids+ips"
            ],
            "default": "off",
            "description": "Pseudonymise identifiers in every result: ids (IMSI, MSISDN, IMEI, SIP users, UE IPs) or ids+ips (every IP too)."
          },
          {
            "name": "TSHARK_MCP_EXPORT_DIR",
            "format": "filepath",
            "description": "Turns on export_subset: the one directory it may write new pcapng files to. Must not overlap an allowed dir. Unset: the server writes nothing."
          }
        ]
      }
    ],
    "repository": {
      "id": "1442215356",
      "url": "https://github.com/Kx96xx/tshark-mcp",
      "source": "github"
    },
    "websiteUrl": "https://github.com/Kx96xx/tshark-mcp",
    "description": "Read-only packet capture analysis with tshark: Diameter, GTP, SIP, RTP, SIGTRAN, DNS, TCP and TLS."
  }
}

Maintain this server? Claim it

Try it

This server only runs locally, from a package. Install it with the instructions on this page to try it.

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM StudioThen replace the YOUR_ values and {placeholders} with your own.

Run in a terminal

claude mcp add tshark-mcp \
  -e TSHARK_MCP_ALLOW_DIRS=YOUR_TSHARK_MCP_ALLOW_DIRS \
  -- uvx tshark-mcp-server==0.2.0

Environment

TSHARK_MCP_ALLOW_DIRS (required): Directories the server may read captures from, colon-separated. Required: the server refuses to start without one.
TSHARK_MCP_TSHARK (optional, not in the config above): Path to the tshark binary (4.0 or newer) when it is not on PATH.
TSHARK_MCP_REDACT (optional, not in the config above): Pseudonymise identifiers in every result: ids (IMSI, MSISDN, IMEI, SIP users, UE IPs) or ids+ips (every IP too).
TSHARK_MCP_EXPORT_DIR (optional, not in the config above): Turns on export_subset: the one directory it may write new pcapng files to. Must not overlap an allowed dir. Unset: the server writes nothing.

Tools

We don't run packages, so we can't list this server's tools.