# mcpcap

![mcpcap logo](https://raw.githubusercontent.com/danohn/mcpcap/main/readme-assets/mcpcap-logo.png)

A modular Python MCP (Model Context Protocol) Server for analyzing PCAP files. mcpcap enables LLMs to read and analyze network packet captures from local or remote sources, providing structured JSON responses about network traffic.

## Overview

mcpcap uses a modular architecture to analyze different network protocols found in PCAP files. Each module focuses on a specific protocol, allowing for targeted analysis and easy extensibility. The server leverages the powerful scapy library for packet parsing and analysis.

### Key Features

- **Modular Architecture**: Easily extensible to support new protocols
- **Local & Remote PCAP Support**: Read files from local directories or HTTP servers
- **Scapy Integration**: Leverages scapy's comprehensive packet parsing capabilities
- **MCP Server**: Integrates seamlessly with LLM clients via Model Context Protocol
- **JSON Responses**: Structured data format for easy LLM consumption

## Installation

mcpcap requires Python 3.10 or greater.

### Using pip

```bash
pip install mcpcap
```

### Using uv

```bash
uv add mcpcap
```

### Using uvx (for one-time usage)

```bash
uvx mcpcap
```

## Quick Start

1. **Start the MCP Server**:

   **Local PCAP file:**
   ```bash
   mcpcap --pcap-path /path/to/specific/file.pcap
   ```

   **Local PCAP directory:**
   ```bash
   mcpcap --pcap-path /path/to/pcap/files
   ```

   **Remote PCAP file:**
   ```bash
   mcpcap --pcap-url https://example.com/sample.pcap
   ```

   **With advanced options:**
   ```bash
   mcpcap --pcap-path /path/to/pcaps --max-packets 100 --protocols dns
   ```

2. **Connect your LLM client** to the MCP server

3. **Ask questions** about your network traffic:
   - "What domain was queried the most in the DNS traffic?"
   - "Show me all DNS queries for example.com"
   - "What are the top 5 queried domains?"

## Modules

### DNS Module

The DNS module analyzes Domain Name System packets in PCAP files.

**Capabilities**:

- Extract DNS queries and responses
- Identify queried domains and subdomains
- Analyze query types (A, AAAA, MX, etc.)
- Track query frequency and patterns
- Identify DNS servers used

**Example Usage**:

```python
# LLM can ask: "What domains were queried in this PCAP?"
# mcpcap will return structured JSON with DNS query information
```

## Configuration

### PCAP Sources

mcpcap supports multiple ways to specify PCAP data sources:

**Local PCAP File**:
```bash
mcpcap --pcap-path /local/path/to/specific.pcap
```

**Local Directory**:
```bash
mcpcap --pcap-path /local/path/to/pcaps
```

**Remote PCAP File (Direct Link)**:
```bash
mcpcap --pcap-url https://wiki.wireshark.org/uploads/dns.cap
```

**Remote Directory Listing**:
```bash
mcpcap --pcap-url http://example.com/pcaps/
```

### Analysis Options

**Module Selection**:
```bash
mcpcap --modules dns --pcap-path /path/to/files
```

**Protocol Filtering**:
```bash
mcpcap --protocols dns --pcap-path /path/to/files
```

**Packet Limiting** (for large files):
```bash
mcpcap --max-packets 1000 --pcap-path /path/to/files
```

**Combined Options**:
```bash
mcpcap --pcap-path /data/capture.pcap --max-packets 500 --protocols dns
```

## CLI Reference

```bash
mcpcap [--pcap-path PATH | --pcap-url URL] [OPTIONS]
```

**Source Options** (choose one):
- `--pcap-path PATH`: Local PCAP file or directory
- `--pcap-url URL`: Remote PCAP file URL or directory listing

**Analysis Options**:
- `--modules MODULES`: Comma-separated modules to load (default: dns)
- `--protocols PROTOCOLS`: Comma-separated protocols to analyze (default: dns) 
- `--max-packets N`: Maximum packets to analyze per file (default: unlimited)

**Examples**:
```bash
# Analyze specific file
mcpcap --pcap-path ./capture.pcap

# Remote file with packet limit
mcpcap --pcap-url https://example.com/dns.cap --max-packets 100

# Directory with protocol filter
mcpcap --pcap-path /captures --protocols dns --modules dns
```

## Example

An example PCAP file (`dns.pcap`) containing DNS traffic is included in the `examples/` directory to help you get started.

## Architecture

mcpcap's modular design makes it easy to extend support for new protocols:

1. **Core Engine**: Handles PCAP file loading and basic packet processing
2. **Protocol Modules**: Individual modules for specific protocols (DNS, etc.)
3. **MCP Interface**: Translates between LLM queries and packet analysis results
4. **Output Formatter**: Converts analysis results to structured JSON

### Adding New Modules

New protocol modules can be added by:

1. Implementing the module interface
2. Defining scapy display filters for the protocol
3. Creating analysis functions specific to the protocol
4. Registering the module with the core engine

Future modules might include:

- BGP (Border Gateway Protocol)
- HTTP/HTTPS traffic analysis
- TCP connection tracking
- And more!

## Remote Access

mcpcap supports reading PCAP files from remote HTTP servers in two modes:

**Direct File Access**: Point directly to a PCAP file URL
```bash
mcpcap --pcap-url https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/dns.cap
```

**Directory Listing**: Parse HTML directory listings to find PCAP files
```bash
mcpcap --pcap-url http://server.com/pcap-files/
```

**Supported File Types**: `.pcap`, `.pcapng`, `.cap`

**Current Limitations**:
- HTTP/HTTPS only (no authentication)
- Directory listings require standard HTML format
- Files are downloaded temporarily for analysis

Future versions may include support for Basic Authentication and other security mechanisms.

## Contributing

Contributions are welcome! Whether you want to:

- Add support for new protocols
- Improve existing modules
- Enhance the MCP interface
- Add new features

Please feel free to open issues and submit pull requests.

## License

MIT

## Requirements

- Python 3.10+
- scapy (packet parsing and analysis)
- requests (HTTP remote file access)
- fastmcp (MCP server framework)
- All dependencies are automatically installed via pip

## Support

For questions, issues, or feature requests, please open an issue on GitHub.
