tshark-mcp runs on your own machine — the client starts it, so there is no endpoint to ping. 842 installs a week from pypi. Last commit 5 Nov 2026.
Read-only packet capture analysis with tshark: Diameter, GTP, SIP, RTP, SIGTRAN, DNS, TCP and TLS.
What the code does
We read the source, 1 d ago · rules 995398eba69f
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
proc = subprocess.Popen(
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
drops_total += if_drop + os_drop
proc = subprocess.Popen(
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch tshark-mcp and you get told the day something new turns up.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add tshark-mcp -e 'TSHARK_MCP_ALLOW_DIRS=<TSHARK_MCP_ALLOW_DIRS>' -- uvx tshark-mcp-server{
"mcpServers": {
"tshark-mcp": {
"command": "uvx",
"args": [
"tshark-mcp-server"
],
"env": {
"TSHARK_MCP_ALLOW_DIRS": "<TSHARK_MCP_ALLOW_DIRS>"
}
}
}
}[mcp_servers.tshark-mcp]
command = "uvx"
args = ["tshark-mcp-server"]
env = { TSHARK_MCP_ALLOW_DIRS = "<TSHARK_MCP_ALLOW_DIRS>" }{
"mcpServers": {
"tshark-mcp": {
"command": "uvx",
"args": [
"tshark-mcp-server"
],
"env": {
"TSHARK_MCP_ALLOW_DIRS": "<TSHARK_MCP_ALLOW_DIRS>"
}
}
}
}{
"servers": {
"tshark-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"tshark-mcp-server"
],
"env": {
"TSHARK_MCP_ALLOW_DIRS": "<TSHARK_MCP_ALLOW_DIRS>"
}
}
}
}Put your own value in place of
<TSHARK_MCP_ALLOW_DIRS> (Directories the server may read captures from, colon-separated. Required: the server refuses to start without one).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
TSHARK_MCP_TSHARK (Path to the tshark binary (4.0 or newer) when it is not on PATH), TSHARK_MCP_REDACT (Pseudonymise identifiers in every result: ids (IMSI, MSISDN, IMEI, SIP users, UE IPs) or ids+ips (every IP too)), TSHARK_MCP_EXPORT_DIR (Turns on export_subset: the one directory it may write new pcapng files to. Must not overlap an allowed dir. Unset: the server writes nothing).
Alternatives to tshark-mcp
same job, measured the same wayRead-only MCP server for ClickHouse metadata, parameterized queries, and plan analysis.
PCAP analysis: DNS, DHCP, ICMP, TCP flows, anomalies, and SIP from capture files.
One Piece TCG MCP server with card search, deck analysis, and set browsing
Generic HAR analysis MCP server: index and query captures without burning tokens on raw files.
Web and MCP change memory with native diff UI; later calls return only what changed.
Compiler-backed read-only Verilog and SystemVerilog project analysis.
Read-only macOS disk analysis with bounded scans, size queries, and extension breakdowns.
Read-only fundamental analysis: P/E, DCF, Graham, Altman Z, Piotroski and margins, with formulas
tshark-mcp — questions
Answers built from our own checks of this server.