Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ai.mcpcap/mcpcap

PYPI · MCPCAP · SCANNED SEP 20

An MCP server for analyzing PCAP files.

Available components

pypi · mcpcap 0
0 this week 0 Trust /100

Recent critical change

CVE-2026-32871 affects this package (4 Aug 2026). See the changelog before you install this server.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security75
Provenance & Transparency32
Schema Quality & AI Usability80
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1557 tokens (~173/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
  • Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the ai.mcpcap/mcpcap MCP server?

ai.mcpcap/mcpcap runs locally as a PyPI package, launched with uvx mcpcap. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · mcpcap

# add to Claude Code
claude mcp add ai-mcpcap-mcpcap -- uvx mcpcap
// .cursor/mcp.json
{
  "mcpServers": {
    "ai-mcpcap-mcpcap": {
      "command": "uvx",
      "args": [
        "mcpcap"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "ai-mcpcap-mcpcap": {
      "command": "uvx",
      "args": [
        "mcpcap"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add ai-mcpcap-mcpcap -- uvx mcpcap
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-mcpcap-mcpcap": {
      "type": "local",
      "command": [
        "uvx",
        "mcpcap"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add ai-mcpcap-mcpcap --command uvx --arg mcpcap
# ~/.hermes/config.yaml
mcp_servers:
  ai-mcpcap-mcpcap:
    command: "uvx"
    args: ["mcpcap"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "ai-mcpcap-mcpcap": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "mcpcap"
      ]
    }
  }
}
# add to Vellum
assistant mcp add ai-mcpcap-mcpcap -t stdio -c uvx -a mcpcap
// mcp.json
{
  "mcpServers": {
    "ai-mcpcap-mcpcap": {
      "command": "uvx",
      "args": [
        "mcpcap"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 0
    • Stability: pass → 0.80 functional
  • 18 Sept 26 0
    • Stability: 0.97 → pass security
  • 16 Sept 26 0
    • Malware scan: unverified → pass ▲ security
  • 14 Sept 26 0
    • Malware scan: pass → unverified ▼ security
  • 11 Sept 26 0
    • Stability: pass → 0.77 functional
  • 10 Sept 26 0
    • Stability: 0.97 → pass security
  • 4 Sept 26 0
    • Stability: pass → 0.80 functional
  • 3 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/mcpcap@0.9.6

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted setuptools.build_meta

Background: Why install scripts are a supply-chain risk →

Vulnerabilities 9 findings
ID CVE Severity Vector Fix available
GHSA-m8x7-r2rg-vh5g CVE-2025-64340 medium CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H yes
GHSA-rww4-4w9c-7733 CVE-2026-27124 high yes
GHSA-vv7q-7jx5-f767 CVE-2026-32871 critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yes
PYSEC-2026-2475 CVE-2025-64340 medium CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H yes
PYSEC-2026-2476 CVE-2026-27124 none yes
PYSEC-2026-338 CVE-2026-32871 critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yes
GHSA-gc5v-m9x4-r6x2 CVE-2026-25645 medium CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N yes
PYSEC-2026-2275 CVE-2026-25645 medium CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N yes
GHSA-cq46-m9x9-j8w2 medium no

Background: What a vulnerability scan can and cannot prove →

Dependencies 79 packages
Packages resolved 79
Stale 5
No linked repository 3
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 9 exposed · ~1,557 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
analyze_capinfos ~176

Return metadata from a PCAP file, similar to Wireshark's capinfos utility. IMPORTANT: This tool expects a FILE PATH or URL, not file content. - For local files: "/path/to/capture.pcap" - For remote files: "https://example.com/capture.pcap" - File uploads are NOT supported - save the file locally first Args: pcap_file: Path to local PCAP file or HTTP URL to remote PCAP file (NOT file content - must be a path or URL) Returns: A structured dictionary containing PCAP metadata including: - File information (size, name, encapsulation type) - Packet statistics (count, data size, average sizes) - Temporal data (duration, timestamps, rates)

NameTypeReqDescription
pcap_filestringyes–

Structured output declared, but exposes no named fields.

No examples provided.

analyze_dhcp_packets ~151

Analyze DHCP packets from a PCAP file and return comprehensive analysis results. FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DHCP packet analysis results

NameTypeReqDescription
pcap_filestringyes–

Structured output declared, but exposes no named fields.

No examples provided.

analyze_dns_packets ~150

Analyze DNS packets from a PCAP file and return comprehensive analysis results. FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing DNS packet analysis results

NameTypeReqDescription
pcap_filestringyes–

Structured output declared, but exposes no named fields.

No examples provided.

analyze_icmp_packets ~153

Analyze ICMP packets from a PCAP file and return comprehensive analysis results. FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing ICMP packet analysis results

NameTypeReqDescription
pcap_filestringyes–

Structured output declared, but exposes no named fields.

No examples provided.

analyze_sip_packets ~151

Analyze SIP packets from a PCAP file and return structured signaling details. FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file Returns: A structured dictionary containing SIP packet analysis results

NameTypeReqDescription
pcap_filestringyes–

Structured output declared, but exposes no named fields.

No examples provided.

analyze_tcp_anomalies ~260

Detect TCP traffic patterns through statistical analysis. This tool analyzes TCP traffic to identify observable patterns without making assumptions about root causes. It provides factual metrics and pattern detection that can be used for further investigation. Args: pcap_file: HTTP URL or absolute local file path to PCAP file server_ip: Optional filter for server IP address server_port: Optional filter for server port Returns: A structured dictionary containing: - statistics: Comprehensive TCP metrics (handshakes, flags, RST distribution, etc.) - patterns: Observable patterns detected in the traffic - summary: High-level summary of findings Detected pattern categories: - connection_establishment: Handshake success/failure rates, SYN response ratios - connection_termination: RST distribution, normal vs abnormal closes - reliability: Retransmission rates, packet loss indicators - connection_lifecycle: Connection state transitions The analysis is purely observational - it reports what is seen in the traffic without attempting to diagnose specific issues like "firewall block" or "network congestion". This allows the data to be interpreted in context.

NameTypeReqDescription
pcap_filestringyes–
server_ip–––
server_port–––

Structured output declared, but exposes no named fields.

No examples provided.

analyze_tcp_connections ~240

Analyze TCP connection states and lifecycle. This is the core tool for TCP connection analysis, solving 80% of TCP-related issues. FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through Claude's web interface. Files must be accessible via URL or local file path. SUPPORTED INPUT FORMATS: - Remote files: "https://example.com/capture.pcap" - Local files: "/absolute/path/to/capture.pcap" UNSUPPORTED: - Files uploaded through Claude's file upload feature - Base64 file content - Relative file paths Args: pcap_file: HTTP URL or absolute local file path to PCAP file server_ip: Optional filter for server IP address server_port: Optional filter for server port detailed: Whether to return detailed connection information Returns: A structured dictionary containing TCP connection analysis results including: - summary: Overall connection statistics - connections: List of individual connections with states - issues: Detected problems

NameTypeReqDescription
detailedboolean––
pcap_filestringyes–
server_ip–––
server_port–––

Structured output declared, but exposes no named fields.

No examples provided.

analyze_tcp_retransmissions ~137

Analyze TCP retransmission patterns. Args: pcap_file: HTTP URL or absolute local file path to PCAP file server_ip: Optional filter for server IP address threshold: Retransmission rate threshold (default: 2%) Returns: A structured dictionary containing: - total_retransmissions: Total number of retransmissions - retransmission_rate: Overall retransmission rate - by_connection: Per-connection retransmission statistics - summary: Worst connections and threshold violations

NameTypeReqDescription
pcap_filestringyes–
server_ip–––
thresholdnumber––

Structured output declared, but exposes no named fields.

No examples provided.

analyze_traffic_flow ~139

Analyze bidirectional traffic flow characteristics. Identifies traffic direction, asymmetry, RST sources, and data transfer patterns. Args: pcap_file: HTTP URL or absolute local file path to PCAP file server_ip: Server IP address (required) server_port: Optional filter for server port Returns: A structured dictionary containing: - client_to_server: Client-to-server traffic statistics - server_to_client: Server-to-client traffic statistics - analysis: Asymmetry analysis and interpretations

NameTypeReqDescription
pcap_filestringyes–
server_ipstringyes–
server_port–––

Structured output declared, but exposes no named fields.

No examples provided.

Common questions

What is the ai.mcpcap/mcpcap MCP server?

ai.mcpcap/mcpcap is an MCP server listed in the public MCP registry as ai.mcpcap/mcpcap. An MCP server for analyzing PCAP files. This page covers its PyPI package (mcpcap).

What tools does the ai.mcpcap/mcpcap MCP server expose?

ai.mcpcap/mcpcap exposes 9 tools: analyze_dns_packets, analyze_dhcp_packets, analyze_icmp_packets, analyze_capinfos, analyze_tcp_connections, and 4 more. Their descriptions and schemas cost roughly 1,557 tokens of context every time the server is loaded.

Is the ai.mcpcap/mcpcap MCP server still maintained?

ai.mcpcap/mcpcap is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.