Netcap

What it does

Netcap converts raw network packets into structured, type-safe Protocol Buffer audit records. It provides a high-performance framework for security monitoring, forensic analysis, and machine learning, featuring 83 packet-layer decoders and 40+ stream decoders.

Tools

• capture: Captures audit records from live interfaces or PCAP files.
• dump: Reads and displays audit record files in CSV, JSON, or table format.
• label: Applies attack labels using Suricata or CSV mappings.
• collect: Acts as a collection server for distributed agents.
• agent: Deploys as a sensor agent for remote capture.
• proxy: Provides HTTP/HTTPS reverse proxy with MITM inspection.
• export: Exports records with Prometheus metrics exposure.

Installation

To use Netcap as an MCP server, you first need to build the binary:

go build -o net ./cmd/

Then add it to your claude_desktop_config.json:

{
  "mcpServers": {
    "netcap": {
      "command": "/path/to/net",
      "args": ["capture", "-read", "traffic.pcap"]
    }
  }
}

Supported hosts

• claude