MCP ServersNetforensicmcp
Created at 3 months ago
by kylecui
NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.
Categories
Tags
wireshark
security
threathunters
threatintelligence
cybersecurity
What is NetForensicMCP?
NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities, built on top of Wireshark's tshark.
How to use NetForensicMCP?
To use NetForensicMCP, clone the repository from GitHub, install the necessary dependencies using npm, and launch the MCP server with the command node index.js.
Key features of NetForensicMCP?
- Smart Stream Analysis for handling large PCAP files
- Threat Intelligence Integration with URLhaus blacklist checking
- Automated Credential Extraction across multiple protocols
- High-Frequency IP Analysis for proactive threat hunting
Use cases of NetForensicMCP?
- Proactive threat hunting for APT activities
- Rapid forensic analysis during incident response
- Compliance auditing for credential leak detection
- Automated IOC extraction and attack reconstruction
FAQ from NetForensicMCP?
- What operating systems are supported?
Windows, macOS, and Linux are supported.
- Is Wireshark required?
Yes, Wireshark (tshark) must be installed and in the system PATH.
- Can it handle large PCAP files?
Yes, it features intelligent content chunking to manage large files efficiently.
View More