WireMCP

WireMCP is a Model Context Protocol (MCP) server that enhances Large Language Models (LLMs) with real-time network traffic analysis through the capture and processing of live data using Wireshark's `tshark`. Its primary use cases include threat hunting, network diagnostics, and anomaly detection, with notable features such as live packet capture, conversation tracking, and threat intelligence checks against blacklist databases, all providing structured JSON outputs suitable for LLM analysis. Additionally, WireMCP enables detailed examination of PCAP files and the extraction of potential credentials, facilitating comprehensive security audits and forensic investigations.