mcpcap/mcpcap

A modular Python MCP (Model Context Protocol) server for analyzing PCAP files. mcpcap exposes protocol-specific analysis tools that accept a local file path or remote HTTP URL at call time, so the server stays stateless and works cleanly with MCP clients.
Overview
mcpcap uses a modular architecture to analyze different network protocols found in PCAP files. Each module provides specialized analysis tools that can be called independently with any PCAP file, making it perfect for integration with Claude Desktop and other MCP clients.
Key Features
- **Stateless MCP Tools**: Each analysis call supplies its own PCAP path or URL
- **Modular Architecture**: DNS, DHCP, ICMP, TCP, SIP, and CapInfos modules with easy extensibility for new protocols
- **Advanced TCP Analysis**: Connection lifecycle, traffic patterns, retransmissions, and flow inspection
- **Local & Remote PCAP Support**: Analyze files from local storage or HTTP URLs
- **Scapy Integration**: Leverages scapy's comprehensive packet parsing capabilities
- **Specialized Analysis Prompts**: Security, networking, and forensic analysis guidance
- **JSON Responses**: Structured data format optimized for LLM consumption
Installation
mcpcap requires Python 3.10 or greater.
Using pip
Using uv
Using uvx (for one-time usage)
Using Docker
Build the image from the repository root:
Run it over HTTP for MCP clients that connect to a network endpoint:
Run it over stdio for clients that can spawn docker run directly:
When you mount local captures into the container, use the container path in tool calls:
Remote http:// and https:// PCAP URLs work without a volume mount because mcpcap downloads them inside the container at call time.
Using Docker Compose
For the default HTTP workflow, start the bundled Compose service:
This pulls ghcr.io/mcpcap/mcpcap:latest, publishes http://127.0.0.1:8080/mcp only on host loopback, and mounts ./examples into the container as /pcaps.
To analyze your own captures, change the volume in docker-compose.yml from ./examples:/pcaps:ro to your local capture directory.
For local development against the checked-out source instead of GHCR:
Quick Start
1. Start the MCP Server
Start mcpcap as a stateless MCP server:
2. Connect Your MCP Client
Use stdio transport for local MCP clients like Claude Desktop:
Use HTTP transport when your MCP client expects a network endpoint:
Point your HTTP-capable MCP client at:
Docker users can publish the same endpoint with:
Or with Compose:
HTTP binds on non-loopback interfaces require the MCPCAP_AUTH_TOKEN environment secret. Set a strong random secret through your secret manager or enter it without recording it in shell history:
Clients must send Authorization: Bearer on every request. Use a TLS reverse proxy and an HTTPS URL for remote clients. A configured token also protects loopback endpoints; stdio is unaffected. The Docker examples use --allow-unauthenticated-http to bind inside the container while publishing only to host loopback. Keep that loopback mapping and use a trusted local Docker network; other containers on the same network can reach the service. Compose forwards MCPCAP_AUTH_TOKEN when set, so you can also secure the local container endpoint. See the HTTP integration guide for details.
3. Analyze PCAP Files
Use the analysis tools with any PCAP file by providing the file path or URL when you call the tool:
**DNS Analysis:**
**DHCP Analysis:**
**ICMP Analysis:**
**TCP Connection Analysis:**
**TCP Pattern Analysis:**
**TCP Retransmission Analysis:**
**Traffic Flow Analysis:**
**SIP Analysis:**
**CapInfos Analysis:**
If you are using Docker with a bind mount, pass the in-container path instead of the host path:
Available Tools
DNS Analysis Tools
- **analyze_dns_packets(pcap_file)**: Complete DNS traffic analysis
- Extract DNS queries and responses