Read-only packet capture analysis with tshark: Diameter, GTP, SIP, RTP, SIGTRAN, DNS, TCP and TLS.
Connect Runs on your machine
claude mcp add tshark-mcp -e TSHARK_MCP_ALLOW_DIRS=<TSHARK_MCP_ALLOW_DIRS> -e TSHARK_MCP_TSHARK=<TSHARK_MCP_TSHARK> -e TSHARK_MCP_REDACT=<TSHARK_MCP_REDACT> -e TSHARK_MCP_EXPORT_DIR=<TSHARK_MCP_EXPORT_DIR> -- uvx tshark-mcp-server==0.4.0{
"mcpServers": {
"tshark-mcp": {
"command": "uvx",
"args": [
"tshark-mcp-server==0.4.0"
],
"env": {
"TSHARK_MCP_ALLOW_DIRS": "<TSHARK_MCP_ALLOW_DIRS>",
"TSHARK_MCP_TSHARK": "<TSHARK_MCP_TSHARK>",
"TSHARK_MCP_REDACT": "<TSHARK_MCP_REDACT>",
"TSHARK_MCP_EXPORT_DIR": "<TSHARK_MCP_EXPORT_DIR>"
}
}
}
}{
"mcpServers": {
"tshark-mcp": {
"command": "uvx",
"args": [
"tshark-mcp-server==0.4.0"
],
"env": {
"TSHARK_MCP_ALLOW_DIRS": "<TSHARK_MCP_ALLOW_DIRS>",
"TSHARK_MCP_TSHARK": "<TSHARK_MCP_TSHARK>",
"TSHARK_MCP_REDACT": "<TSHARK_MCP_REDACT>",
"TSHARK_MCP_EXPORT_DIR": "<TSHARK_MCP_EXPORT_DIR>"
}
}
}
}{
"servers": {
"tshark-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"tshark-mcp-server==0.4.0"
],
"env": {
"TSHARK_MCP_ALLOW_DIRS": "<TSHARK_MCP_ALLOW_DIRS>",
"TSHARK_MCP_TSHARK": "<TSHARK_MCP_TSHARK>",
"TSHARK_MCP_REDACT": "<TSHARK_MCP_REDACT>",
"TSHARK_MCP_EXPORT_DIR": "<TSHARK_MCP_EXPORT_DIR>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
TSHARK_MCP_ALLOW_DIRSRequired | Directories the server may read captures from, colon-separated. Required: the server refuses to start without one. |
TSHARK_MCP_TSHARKOptional | Path to the tshark binary (4.0 or newer) when it is not on PATH. |
TSHARK_MCP_REDACTOptional | Pseudonymise identifiers in every result: ids (IMSI, MSISDN, IMEI, SIP users, UE IPs) or ids+ips (every IP too). |
TSHARK_MCP_EXPORT_DIROptional | Turns on export_subset: the one directory it may write new pcapng files to. Must not overlap an allowed dir. Unset: the server writes nothing. |
Details
| Package | [email protected] (PYPI, stdio) |
| First published | 13 Nov 2026 |
| Last updated | 13 Nov 2026 |
| Registry name | io.github.Kx96xx/tshark-mcp |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.