# mcpacket
A modular Python MCP (Model Context Protocol) Server for analyzing PCAP files. mcpacket enables LLMs to read and analyze network packet captures from local or remote sources, providing structured JSON responses about network traffic.
## Overview
mcpacket uses a modular architecture to analyze different network protocols found in PCAP files. Each module focuses on a specific protocol, allowing for targeted analysis and easy extensibility. The server leverages the powerful scapy library for packet parsing and analysis.
### Key Features
- **Modular Architecture**: Easily extensible to support new protocols
- **Local & Remote PCAP Support**: Read files from local directories or HTTP servers
- **Scapy Integration**: Leverages scapy's comprehensive packet parsing capabilities
- **MCP Server**: Integrates seamlessly with LLM clients via Model Context Protocol
- **JSON Responses**: Structured data format for easy LLM consumption
## Installation
mcpacket requires Python 3.10 or greater.
### Using pip
```bash
pip install mcpacket
```
### Using uv
```bash
uv add mcpacket
```
### Using uvx (for one-time usage)
```bash
uvx mcpacket
```
## Quick Start
1. **Start the MCP Server**:
```bash
mcpacket --pcap-path /path/to/pcap/files
```
2. **Connect your LLM client** to the MCP server
3. **Ask questions** about your network traffic:
- "What domain was queried the most in the DNS traffic?"
- "Show me all DNS queries for example.com"
- "What are the top 5 queried domains?"
## Modules
### DNS Module
The DNS module analyzes Domain Name System packets in PCAP files.
**Capabilities**:
- Extract DNS queries and responses
- Identify queried domains and subdomains
- Analyze query types (A, AAAA, MX, etc.)
- Track query frequency and patterns
- Identify DNS servers used
**Example Usage**:
```python
# LLM can ask: "What domains were queried in this PCAP?"
# mcpacket will return structured JSON with DNS query information
```
## Configuration
### PCAP Sources
**Local Directory**:
```bash
mcpacket --pcap-path /local/path/to/pcaps
```
**Remote HTTP Server**:
```bash
mcpacket --pcap-url http://example.com/pcaps/
```
### Module Selection
```bash
mcpacket --modules dns --pcap-path /path/to/files
```
## Example
An example PCAP file (`example.pcap`) containing DNS traffic is included with the project to help you get started.
## Architecture
mcpacket's modular design makes it easy to extend support for new protocols:
1. **Core Engine**: Handles PCAP file loading and basic packet processing
2. **Protocol Modules**: Individual modules for specific protocols (DNS, etc.)
3. **MCP Interface**: Translates between LLM queries and packet analysis results
4. **Output Formatter**: Converts analysis results to structured JSON
### Adding New Modules
New protocol modules can be added by:
1. Implementing the module interface
2. Defining scapy display filters for the protocol
3. Creating analysis functions specific to the protocol
4. Registering the module with the core engine
Future modules might include:
- BGP (Border Gateway Protocol)
- HTTP/HTTPS traffic analysis
- TCP connection tracking
- And more!
## Remote Access
mcpacket supports reading PCAP files from remote HTTP servers without authentication. Future versions may include support for Basic Authentication and other security mechanisms.
## Contributing
Contributions are welcome! Whether you want to:
- Add support for new protocols
- Improve existing modules
- Enhance the MCP interface
- Add new features
Please feel free to open issues and submit pull requests.
## License
MIT
## Requirements
- Python 3.10+
- scapy
- MCP server dependencies (automatically installed)
## Support
For questions, issues, or feature requests, please open an issue on GitHub.
Raw data
{
"_id": null,
"home_page": null,
"name": "mcpacket",
"maintainer": null,
"docs_url": null,
"requires_python": ">=3.10",
"maintainer_email": null,
"keywords": "pcap, network, analysis, mcp, dns",
"author": "mcpacket contributors",
"author_email": null,
"download_url": "https://files.pythonhosted.org/packages/df/6f/8a5374eb2923808289c6085a8d8a68e2bc0075549199b2d6c3dbd60fa2d4/mcpacket-0.1.3.tar.gz",
"platform": null,
"description": "# mcpacket\n\n\n\nA modular Python MCP (Model Context Protocol) Server for analyzing PCAP files. mcpacket enables LLMs to read and analyze network packet captures from local or remote sources, providing structured JSON responses about network traffic.\n\n## Overview\n\nmcpacket uses a modular architecture to analyze different network protocols found in PCAP files. Each module focuses on a specific protocol, allowing for targeted analysis and easy extensibility. The server leverages the powerful scapy library for packet parsing and analysis.\n\n### Key Features\n\n- **Modular Architecture**: Easily extensible to support new protocols\n- **Local & Remote PCAP Support**: Read files from local directories or HTTP servers\n- **Scapy Integration**: Leverages scapy's comprehensive packet parsing capabilities\n- **MCP Server**: Integrates seamlessly with LLM clients via Model Context Protocol\n- **JSON Responses**: Structured data format for easy LLM consumption\n\n## Installation\n\nmcpacket requires Python 3.10 or greater.\n\n### Using pip\n\n```bash\npip install mcpacket\n```\n\n### Using uv\n\n```bash\nuv add mcpacket\n```\n\n### Using uvx (for one-time usage)\n\n```bash\nuvx mcpacket\n```\n\n## Quick Start\n\n1. **Start the MCP Server**:\n\n ```bash\n mcpacket --pcap-path /path/to/pcap/files\n ```\n\n2. **Connect your LLM client** to the MCP server\n\n3. **Ask questions** about your network traffic:\n - \"What domain was queried the most in the DNS traffic?\"\n - \"Show me all DNS queries for example.com\"\n - \"What are the top 5 queried domains?\"\n\n## Modules\n\n### DNS Module\n\nThe DNS module analyzes Domain Name System packets in PCAP files.\n\n**Capabilities**:\n\n- Extract DNS queries and responses\n- Identify queried domains and subdomains\n- Analyze query types (A, AAAA, MX, etc.)\n- Track query frequency and patterns\n- Identify DNS servers used\n\n**Example Usage**:\n\n```python\n# LLM can ask: \"What domains were queried in this PCAP?\"\n# mcpacket will return structured JSON with DNS query information\n```\n\n## Configuration\n\n### PCAP Sources\n\n**Local Directory**:\n\n```bash\nmcpacket --pcap-path /local/path/to/pcaps\n```\n\n**Remote HTTP Server**:\n\n```bash\nmcpacket --pcap-url http://example.com/pcaps/\n```\n\n### Module Selection\n\n```bash\nmcpacket --modules dns --pcap-path /path/to/files\n```\n\n## Example\n\nAn example PCAP file (`example.pcap`) containing DNS traffic is included with the project to help you get started.\n\n## Architecture\n\nmcpacket's modular design makes it easy to extend support for new protocols:\n\n1. **Core Engine**: Handles PCAP file loading and basic packet processing\n2. **Protocol Modules**: Individual modules for specific protocols (DNS, etc.)\n3. **MCP Interface**: Translates between LLM queries and packet analysis results\n4. **Output Formatter**: Converts analysis results to structured JSON\n\n### Adding New Modules\n\nNew protocol modules can be added by:\n\n1. Implementing the module interface\n2. Defining scapy display filters for the protocol\n3. Creating analysis functions specific to the protocol\n4. Registering the module with the core engine\n\nFuture modules might include:\n\n- BGP (Border Gateway Protocol)\n- HTTP/HTTPS traffic analysis\n- TCP connection tracking\n- And more!\n\n## Remote Access\n\nmcpacket supports reading PCAP files from remote HTTP servers without authentication. Future versions may include support for Basic Authentication and other security mechanisms.\n\n## Contributing\n\nContributions are welcome! Whether you want to:\n\n- Add support for new protocols\n- Improve existing modules\n- Enhance the MCP interface\n- Add new features\n\nPlease feel free to open issues and submit pull requests.\n\n## License\n\nMIT\n\n## Requirements\n\n- Python 3.10+\n- scapy\n- MCP server dependencies (automatically installed)\n\n## Support\n\nFor questions, issues, or feature requests, please open an issue on GitHub.\n",
"bugtrack_url": null,
"license": "MIT",
"summary": "A modular Python MCP Server for analyzing PCAP files",
"version": "0.1.3",
"project_urls": {
"Homepage": "https://github.com/danohn/mcpacket",
"Issues": "https://github.com/danohn/mcpacket/issues",
"Repository": "https://github.com/danohn/mcpacket"
},
"split_keywords": [
"pcap",
" network",
" analysis",
" mcp",
" dns"
],
"urls": [
{
"comment_text": null,
"digests": {
"blake2b_256": "28278f73769e7ac9fa19738e6920d39fec750a89842b0164f86bfb478754b7b7",
"md5": "d77958777061bb436df1982f000dc1a3",
"sha256": "11e9c9a62bb8a2bc522899bc41f0641d2f0fa3a1e2a17ecdeec8288b800bd979"
},
"downloads": -1,
"filename": "mcpacket-0.1.3-py3-none-any.whl",
"has_sig": false,
"md5_digest": "d77958777061bb436df1982f000dc1a3",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.10",
"size": 14126,
"upload_time": "2025-09-09T05:38:39",
"upload_time_iso_8601": "2025-09-09T05:38:39.203592Z",
"url": "https://files.pythonhosted.org/packages/28/27/8f73769e7ac9fa19738e6920d39fec750a89842b0164f86bfb478754b7b7/mcpacket-0.1.3-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": null,
"digests": {
"blake2b_256": "df6f8a5374eb2923808289c6085a8d8a68e2bc0075549199b2d6c3dbd60fa2d4",
"md5": "f526267c0d6df97166de9a6a7c3db9c9",
"sha256": "544ce028817e83e3d5c620fb235b9479373a2dfc8e6ccedde8c4adcebf062f30"
},
"downloads": -1,
"filename": "mcpacket-0.1.3.tar.gz",
"has_sig": false,
"md5_digest": "f526267c0d6df97166de9a6a7c3db9c9",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.10",
"size": 1623590,
"upload_time": "2025-09-09T05:38:40",
"upload_time_iso_8601": "2025-09-09T05:38:40.387973Z",
"url": "https://files.pythonhosted.org/packages/df/6f/8a5374eb2923808289c6085a8d8a68e2bc0075549199b2d6c3dbd60fa2d4/mcpacket-0.1.3.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2025-09-09 05:38:40",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "danohn",
"github_project": "mcpacket",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"requirements": [
{
"name": "annotated-types",
"specs": [
[
"==",
"0.7.0"
]
]
},
{
"name": "anyio",
"specs": [
[
"==",
"4.10.0"
]
]
},
{
"name": "attrs",
"specs": [
[
"==",
"25.3.0"
]
]
},
{
"name": "Authlib",
"specs": [
[
"==",
"1.6.3"
]
]
},
{
"name": "certifi",
"specs": [
[
"==",
"2025.8.3"
]
]
},
{
"name": "cffi",
"specs": [
[
"==",
"2.0.0"
]
]
},
{
"name": "charset-normalizer",
"specs": [
[
"==",
"3.4.3"
]
]
},
{
"name": "click",
"specs": [
[
"==",
"8.2.1"
]
]
},
{
"name": "cryptography",
"specs": [
[
"==",
"45.0.7"
]
]
},
{
"name": "cyclopts",
"specs": [
[
"==",
"3.24.0"
]
]
},
{
"name": "dnspython",
"specs": [
[
"==",
"2.8.0"
]
]
},
{
"name": "docstring_parser",
"specs": [
[
"==",
"0.17.0"
]
]
},
{
"name": "docutils",
"specs": [
[
"==",
"0.22"
]
]
},
{
"name": "email-validator",
"specs": [
[
"==",
"2.3.0"
]
]
},
{
"name": "exceptiongroup",
"specs": [
[
"==",
"1.3.0"
]
]
},
{
"name": "fastmcp",
"specs": [
[
"==",
"2.12.2"
]
]
},
{
"name": "h11",
"specs": [
[
"==",
"0.16.0"
]
]
},
{
"name": "httpcore",
"specs": [
[
"==",
"1.0.9"
]
]
},
{
"name": "httpx",
"specs": [
[
"==",
"0.28.1"
]
]
},
{
"name": "httpx-sse",
"specs": [
[
"==",
"0.4.1"
]
]
},
{
"name": "idna",
"specs": [
[
"==",
"3.10"
]
]
},
{
"name": "isodate",
"specs": [
[
"==",
"0.7.2"
]
]
},
{
"name": "jsonschema",
"specs": [
[
"==",
"4.25.1"
]
]
},
{
"name": "jsonschema-path",
"specs": [
[
"==",
"0.3.4"
]
]
},
{
"name": "jsonschema-specifications",
"specs": [
[
"==",
"2025.9.1"
]
]
},
{
"name": "lazy-object-proxy",
"specs": [
[
"==",
"1.12.0"
]
]
},
{
"name": "markdown-it-py",
"specs": [
[
"==",
"4.0.0"
]
]
},
{
"name": "MarkupSafe",
"specs": [
[
"==",
"3.0.2"
]
]
},
{
"name": "mcp",
"specs": [
[
"==",
"1.13.1"
]
]
},
{
"name": "mdurl",
"specs": [
[
"==",
"0.1.2"
]
]
},
{
"name": "more-itertools",
"specs": [
[
"==",
"10.8.0"
]
]
},
{
"name": "openapi-core",
"specs": [
[
"==",
"0.19.5"
]
]
},
{
"name": "openapi-pydantic",
"specs": [
[
"==",
"0.5.1"
]
]
},
{
"name": "openapi-schema-validator",
"specs": [
[
"==",
"0.6.3"
]
]
},
{
"name": "openapi-spec-validator",
"specs": [
[
"==",
"0.7.2"
]
]
},
{
"name": "parse",
"specs": [
[
"==",
"1.20.2"
]
]
},
{
"name": "pathable",
"specs": [
[
"==",
"0.4.4"
]
]
},
{
"name": "pycparser",
"specs": [
[
"==",
"2.22"
]
]
},
{
"name": "pydantic",
"specs": [
[
"==",
"2.11.7"
]
]
},
{
"name": "pydantic-settings",
"specs": [
[
"==",
"2.10.1"
]
]
},
{
"name": "pydantic_core",
"specs": [
[
"==",
"2.33.2"
]
]
},
{
"name": "Pygments",
"specs": [
[
"==",
"2.19.2"
]
]
},
{
"name": "pyperclip",
"specs": [
[
"==",
"1.9.0"
]
]
},
{
"name": "python-dotenv",
"specs": [
[
"==",
"1.1.1"
]
]
},
{
"name": "python-multipart",
"specs": [
[
"==",
"0.0.20"
]
]
},
{
"name": "PyYAML",
"specs": [
[
"==",
"6.0.2"
]
]
},
{
"name": "referencing",
"specs": [
[
"==",
"0.36.2"
]
]
},
{
"name": "requests",
"specs": [
[
"==",
"2.32.5"
]
]
},
{
"name": "rfc3339-validator",
"specs": [
[
"==",
"0.1.4"
]
]
},
{
"name": "rich",
"specs": [
[
"==",
"14.1.0"
]
]
},
{
"name": "rich-rst",
"specs": [
[
"==",
"1.3.1"
]
]
},
{
"name": "rpds-py",
"specs": [
[
"==",
"0.27.1"
]
]
},
{
"name": "scapy",
"specs": [
[
"==",
"2.6.1"
]
]
},
{
"name": "six",
"specs": [
[
"==",
"1.17.0"
]
]
},
{
"name": "sniffio",
"specs": [
[
"==",
"1.3.1"
]
]
},
{
"name": "sse-starlette",
"specs": [
[
"==",
"3.0.2"
]
]
},
{
"name": "starlette",
"specs": [
[
"==",
"0.47.3"
]
]
},
{
"name": "typing-inspection",
"specs": [
[
"==",
"0.4.1"
]
]
},
{
"name": "typing_extensions",
"specs": [
[
"==",
"4.15.0"
]
]
},
{
"name": "urllib3",
"specs": [
[
"==",
"2.5.0"
]
]
},
{
"name": "uvicorn",
"specs": [
[
"==",
"0.35.0"
]
]
},
{
"name": "Werkzeug",
"specs": [
[
"==",
"3.1.1"
]
]
}
],
"lcname": "mcpacket"
}
