Cap MCP server
{
"mcpServers": {
"mcpcap-cap": {
"command": "uvx",
"args": [
"mcpcap"
]
}
}
}{
"mcpServers": {
"mcpcap-cap": {
"command": "uvx",
"args": [
"mcpcap"
]
}
}
}{
"mcpServers": {
"mcpcap-cap": {
"command": "uvx",
"args": [
"mcpcap"
]
}
}
}{
"servers": {
"mcpcap-cap": {
"command": "uvx",
"args": [
"mcpcap"
]
}
}
}{
"mcpServers": {
"mcpcap-cap": {
"command": "uvx",
"args": [
"mcpcap"
]
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall uvx mcpcapversion 0.9.6
What it does
mcpcap is an MCP server for analyzing PCAP network capture files. It provides protocol-specific analysis tools for DNS, DHCP, ICMP, TCP, SIP, and general packet inspection, accepting local file paths or remote HTTP URLs at call time. It is for developers and network analysts who need to examine network traffic programmatically through an LLM interface.
- Analyze DNS queries and responses in a PCAP file to identify queried domains and traffic patterns.
- Inspect TCP connections to examine connection lifecycles, retransmissions, and traffic anomalies.
- Extract and analyze SIP packets from VoIP captures to understand call signaling flows.
Tools this server exposes
| Tool | Does |
|---|---|
| analyze_dns_packets | Extract and analyze DNS queries, responses, queried domains, query types, and frequency patterns from a PCAP file. |
| analyze_dhcp_packets | Track DHCP transactions and identify DHCP clients and servers in a PCAP file. |
| analyze_icmp_packets | Analyze ICMP traffic in a PCAP file. |
| analyze_tcp_connections | Examine TCP connection lifecycles with optional filtering by server IP and port. |
| analyze_tcp_anomalies | Analyze TCP traffic patterns and anomalies for a specified server IP. |
| analyze_tcp_retransmissions | Identify and analyze TCP retransmission events in a PCAP file. |
| analyze_traffic_flow | Inspect traffic flow patterns for a specified server IP in a PCAP file. |
| analyze_sip_packets | Analyze SIP protocol packets and call signaling flows in a PCAP file. |
| analyze_capinfos | Provide general information about a PCAP file's contents. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.