How do I install the Wireshark MCP skill?

Run npx skillmds@latest add a-g-u-p-t-a/wireshark-mcp in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Wireshark MCP safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Wireshark MCP?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Wireshark MCP free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Wireshark MCP?

A-G-U-P-T-A (@a-g-u-p-t-a) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Wireshark MCP by a-g-u-p-t-a — Agent Skill

Name: Wireshark MCP
Rating: 4.2 (5 reviews)
Author: A-G-U-P-T-A

Wireshark MCP

Use the wireshark MCP server for authorized packet capture and analysis with TShark. Apply when investigating live traffic, reading pcap/pcapng files, debugging DNS/HTTP/TLS, or working on the wireshark-mcp codebase itself.

A-G-U-P-T-A Updated Sep 10, 2026

File contents

Wireshark MCP

Works with any stdio MCP host (Cursor, Claude, VS Code, custom agents).

When to use

Live or offline packet analysis via the wireshark MCP server
Choosing the right tool (quick_capture, DNS/HTTP analysis, expert info, etc.)
Editing this repository’s MCP tools/prompts

Hard rules

Call list_interfaces first; pass an exact returned interface name.
Prefer short captures (duration 3–10s, modest packet_limit).
Never invent traffic. If a tool returns Error: ..., report that failure.
Only capture traffic you are authorized to inspect.
Treat pcaps and verbose dumps as sensitive; redact secrets before sharing.

Setup / online status

Hosts show the MCP online only after the process starts. This server exits if TShark is missing. If offline:

python -m wireshark_mcp doctor
python -m wireshark_mcp setup (prompts for TShark path; writes/prints mcpServers JSON)
Reload/restart MCP in the host

In-session: check_environment, configure_tshark. See docs/Setup.md.

Tool cheat-sheet

Goal	Tool
Deps / path	`check_environment`, `configure_tshark`
List NICs	`list_interfaces`
Quick sample	`quick_capture`
Quick insights	`quick_traffic_analysis`
Deep tabular	`deep_packet_analysis`
Protocol tree	`protocol_hierarchy_statistics`
DNS	`analyze_dns_traffic`
HTTP/TLS tables	`analyze_http_traffic_tabular`
Offline summary	`read_pcap_file`
HTTP from file	`analyze_http_traffic`
Display filter	`filtered_packet_display`
Expert warnings	`expert_information`
Save pcap	`save_capture_to_file`

MCP prompts

investigate_live_traffic
analyze_pcap_file
security_traffic_review
safe_capture_rules
packet_capture_help

Local run

python -m wireshark_mcp setup
python -m wireshark_mcp

Requires TShark (PATH or TSHARK_PATH) and Npcap (Windows) / libpcap (Unix) for live capture.

---name: wireshark-mcpdescription: Use the wireshark MCP server for authorized packet capture and analysis with TShark. Apply when investigating live traffic, reading pcap/pcapng files, debugging DNS/HTTP/TLS, or working on the wireshark-mcp codebase itself.---# Wireshark MCPWorks with any stdio MCP host (Cursor, Claude, VS Code, custom agents).## When to use- Live or offline packet analysis via the `wireshark` MCP server- Choosing the right tool (`quick_capture`, DNS/HTTP analysis, expert info, etc.)- Editing this repository’s MCP tools/prompts## Hard rules1. Call `list_interfaces` first; pass an **exact** returned interface name.2. Prefer short captures (`duration` 3–10s, modest `packet_limit`).3. **Never invent traffic.** If a tool returns `Error: ...`, report that failure.4. Only capture traffic you are authorized to inspect.5. Treat pcaps and verbose dumps as sensitive; redact secrets before sharing.## Setup / online statusHosts show the MCP online only after the process starts. This server **exits if TShark is missing**. If offline:1. `python -m wireshark_mcp doctor`2. `python -m wireshark_mcp setup` (prompts for TShark path; writes/prints `mcpServers` JSON)3. Reload/restart MCP in the hostIn-session: `check_environment`, `configure_tshark`. See `docs/Setup.md`.## Tool cheat-sheet| Goal | Tool ||------|------|| Deps / path | `check_environment`, `configure_tshark` || List NICs | `list_interfaces` || Quick sample | `quick_capture` || Quick insights | `quick_traffic_analysis` || Deep tabular | `deep_packet_analysis` || Protocol tree | `protocol_hierarchy_statistics` || DNS | `analyze_dns_traffic` || HTTP/TLS tables | `analyze_http_traffic_tabular` || Offline summary | `read_pcap_file` || HTTP from file | `analyze_http_traffic` || Display filter | `filtered_packet_display` || Expert warnings | `expert_information` || Save pcap | `save_capture_to_file` |## MCP prompts- `investigate_live_traffic`- `analyze_pcap_file`- `security_traffic_review`- `safe_capture_rules`- `packet_capture_help`## Local run```textpython -m wireshark_mcp setuppython -m wireshark_mcp```Requires TShark (`PATH` or `TSHARK_PATH`) and Npcap (Windows) / libpcap (Unix) for live capture.

Frequently asked questions

Wireshark MCP

File contents

Wireshark MCP

When to use

Hard rules

Setup / online status

Tool cheat-sheet

MCP prompts

Local run

Related skills

Frequently asked questions

How do I install the Wireshark MCP skill?

What does the Wireshark MCP skill do?

Is Wireshark MCP safe to use?

Which AI agents work with Wireshark MCP?

Is Wireshark MCP free to use?

Who published Wireshark MCP?