PacketMaster

MCP server for network-troubleshooting PCAP analysis via tshark. Pairs with Cursor skills pcap-troubleshooting (domain workflows) and packetmaster-mcp (MCP tool usage).

Prerequisites

• Python 3.10+
• uv (recommended) or pip
• Wireshark with CLI tools: tshark, capinfos

brew install wireshark   # macOS

PacketMaster auto-detects `/Applications/Wireshark.app/Contents/MacOS/tshark` if not on PATH.

Install

cd "/Users/networkze/Documents/Claude Projects/PacketMaster"
uv sync --extra dev

Cursor MCP Configuration

Install the launcher (once), then add to ~/.cursor/mcp.json:

mkdir -p ~/.packetmaster-mcp
cp scripts/start-mcp.sh ~/.packetmaster-mcp/start-mcp.sh
chmod +x ~/.packetmaster-mcp/start-mcp.sh

{
  "mcpServers": {
    "packetmaster": {
      "command": "/Users/networkze/.packetmaster-mcp/start-mcp.sh",
      "env": {
        "FASTMCP_SHOW_SERVER_BANNER": "false"
      }
    }
  }
}

Uses a launcher script (like flipper-zero) because Cursor can break uv run paths that contain spaces.

PCAP paths must be absolute. By default any readable .pcap on disk is allowed. Set PM_ALLOWED_DIRS only if you want an opt-in sandbox.

Environment Variables

Tools

Workflow with NetOps EPC

1. Capture via ios_xe_epc_capture_run (user-netops MCP) with pull_pcap=true
2. Run pm_troubleshoot_quick_scan on the returned local_path
3. Drill down with pm_troubleshoot_flow on suspect IPs

Development

uv run pytest -q
uv run packetmaster-mcp   # stdio MCP server

Security

• PCAP paths must be absolute; optional PM_ALLOWED_DIRS sandbox for locked-down setups
• Symlinks rejected
• Stream/field output redacts Authorization, Bearer tokens, passwords by default
• Confirm with user before pm_follow_stream on production captures