WireMCP

Why we included this project

WireMCP sits between Wireshark's tshark and an LLM assistant, turning live packet captures into structured JSON a model can actually reason about. Its tools cover the basics you'd want: capture packets, summarize protocol hierarchies, and report TCP/UDP conversations, so an assistant can answer real questions about what is moving across the network instead of guessing. The threat-checking tools look up IPs against the URLhaus blacklist and other feeds, which makes it handy for security teams doing quick triage or threat hunting from a chat interface. It also reads existing PCAP files and can pull plaintext credentials out of HTTP Basic Auth, FTP, and Telnet sessions, which helps with forensic review and security audits. If your team already lives in tshark, this is a thin wrapper that keeps the raw data visible and lets the model do the interpretation and reporting.