Mcpcap MCP Server for PCAP Analysis

Overview

Mcpcap is an MCP (Model Context Protocol) server designed to enable large language models (LLMs) and agents to analyze PCAP (packet capture) files without requiring file uploads. It exposes protocol-aware tools and file access wrappers over local filesystem paths and remote URLs, so LLM-based workflows can request protocol-specific summaries, flow extraction, metadata, or filtered packet data using simple MCP calls.

This architecture is useful for security analysts, network engineers, and ML-driven observability pipelines that need fine-grained, on-demand PCAP inspection while keeping raw packet captures on-premises or behind existing storage controls. By serving content via an MCP endpoint, mcpcap provides an out-of-the-box bridge between LLM agents and packet inspection utilities without changing existing file storage locations.

Features

• LLM-accessible PCAP analysis via MCP (Model Context Protocol) interface
• Support for local file paths and remote URLs (no upload required)
• Protocol-aware parsing: HTTP, DNS, TLS/SSL, TCP/UDP flows, etc.
• Extract flows, sessions, and metadata (timestamps, endpoints, sizes)
• Filtered extraction using BPF or protocol filters
• Configurable access control (restrict allowed filesystem roots or domains)
• Docker-ready and command-line launch options
• Simple JSON API for integration with LLM agents, orchestration, and CI

Installation / Configuration

Clone the repository and run using Docker or a local Python runtime. Example commands below assume the repository at https://github.com/mcpcap/mcpcap.

Clone repo:

git clone https://github.com/mcpcap/mcpcap.git
cd mcpcap

Run with Docker (recommended for isolation):

# Build locally (if an image isn't published)
docker build -t mcpcap:latest .

# Run server, exposing port 8080 and binding allowed path /data/pcaps
docker run -p 8080:8080 \
  -e MCPCAP_PORT=8080 \
  -e MCPCAP_ALLOWED_ROOT=/data/pcaps \
  -v /local/pcaps:/data/pcaps:ro \
  mcpcap:latest

Run locally (Python virtualenv example):

python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# Example environment variables and run command
export MCPCAP_HOST=0.0.0.0
export MCPCAP_PORT=8080
export MCPCAP_ALLOWED_ROOT=/var/pcaps
export MCPCAP_API_KEY="your-api-key"
python -m mcpcap.server

Configuration file example (YAML):

host: 0.0.0.0
port: 8080
api_key: your-api-key
allowed_roots:
  - /var/pcaps
  - /mnt/shared/pcaps
max_file_size: 200000000  # 200 MB
enable_remote_fetch: true

Environment variables (common):

Available Tools / Resources

Mcpcap exposes a set of MCP-accessible resources and analysis tools that LLM agents can call. Typical capabilities include:

• pcap:open — Open and stream a PCAP by local path (within allowed roots) or remote URL.
• pcap:metadata — Return capture metadata: start/end timestamps, packet count, protocols seen.
• pcap:flows — Extract TCP/UDP flows and session summaries.
• pcap:extract — Extract packets matching a BPF expression or protocol filter (e.g., “http.request”).
• pcap:download — Provide a temporary, read-only URL for a remote or local PCAP (if allowed).
• pcap:search — Search payloads or headers for strings or regexes.
• pcap:tls-info — Extract TLS SNI, certificates, and handshake metadata.

Each tool returns structured JSON suitable for LLM consumption (short summaries, tables of sessions, or snippets of relevant packets).

Use Cases

1. Incident Triage — Summarize suspect capture

   • Ask an LLM to call pcap:metadata and pcap:flows for /var/pcaps/incident-123.pcap to get endpoints, top talkers, and suspicious flows. The agent can then produce a one-page incident summary with IOC candidates (IP addresses, domains).

2. HTTP Session Extraction for Forensics

   • Use pcap:extract with a filter for HTTP requests and then pcap:open to fetch request/response bodies. This enables automated extraction of files transferred in cleartext for evidence collection.

3. Remote Capture Analysis without Uploads

   • Point mcpcap at a remote URL (S3, HTTP) and enable remote fetch. The LLM can summarize the capture content and produce specific queries (e.g., “show all DNS queries for suspicious domains”) without the analyst uploading the capture to external services.

4. Enrich SIEM Alerts

   • Integrate mcpcap into alert playbooks: an alert triggers an agent to call pcap:flows and pcap:search for enrichment fields (session duration, bytes transferred, user agents) that can be appended to an event in SIEM.

Example curl request to ask the server to summarize a local PCAP:

curl -X POST "http://localhost:8080/mcp/v1/analyze" \
  -H "Authorization: Bearer $MCPCAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "pcap:metadata",
    "