Skip to main content

TCP Viewer MCP for AI Agents

TCP Viewer MCP lets an AI assistant work with the capture open in TCP Viewer. You can ask for packet summaries, find matching traffic, inspect decoded fields, export a selection, or control a live capture in natural language.

MCP is a TCP Viewer PRO feature. The app runs a local bridge on 127.0.0.1 and uses a private key that changes for each launch.

Codex querying TCP Viewer through MCP

Codex checks TCP Viewer status, lists capture interfaces, and queries packets through the local MCP connection.

1. Benefits​

  • ✅ Query packets with bounded filters and pagination.
  • ✅ Summarize protocols, domains, clients, bytes, issues, and time ranges.
  • ✅ Read decoded details or a limited raw-byte range for one packet.
  • ✅ List interfaces and TCP or UDP streams.
  • ✅ Start, pause, resume, or stop a live capture.
  • ✅ Export filtered packets to PCAP or PCAPNG.
  • ✅ Redact sensitive values before decoded data is sent to the MCP client.

2. Enable the MCP server​

  1. Activate a TCP Viewer PRO license.
  2. Open TCP Viewer → Settings… → MCP.
  3. Turn on Enable MCP Server.
  4. Keep Redact Sensitive Data Before Sending to AI enabled unless you have a clear reason to send full values.
  5. Confirm the status shows Running on localhost.

Redaction scrubs common authorization headers, cookies, credentials, private keys, tokens, and sensitive query or body fields. Raw packet-byte access is blocked while redaction is enabled because arbitrary binary data cannot be scrubbed safely.

3. Connect Codex or Claude Code​

The MCP settings show a command with the exact path for your installed app. Choose a client, select Copy, paste the command into Terminal, and restart the client if needed.

For a normal /Applications install, the commands look like:

codex mcp add tcpviewer -- '/Applications/TCP Viewer.app/Contents/MacOS/tcpviewer-mcp'
claude mcp add --transport stdio --scope user tcpviewer -- '/Applications/TCP Viewer.app/Contents/MacOS/tcpviewer-mcp'

Choose Manual in TCP Viewer settings for a JSON configuration that works with other MCP-compatible clients.

4. Try useful prompts​

  • “Summarize the last 5,000 packets by protocol and domain.”
  • “Find recent TLS packets for api.example.com.”
  • “Show the decoded details for packet 120.”
  • “List the capture interfaces and tell me which one is active.”
  • “Export DNS packets to /Users/me/Desktop/dns.pcapng.”

TCP Viewer bounds scans and responses so large captures do not create unlimited results. Ask for another page or window when you need more data.

5. Understand capture filters​

For normal questions, the MCP client should query packets already captured. This does not change the app's Filter field or hide data in the UI.

A BPF capture filter is a stronger action. It changes which future packets are collected, and packets that do not match are lost from that capture. TCP Viewer requires explicit confirmation before an MCP client can set a non-empty BPF filter. The toolbar shows a yellow filter indicator while one is configured.

Use a BPF filter only when reducing traffic at capture time is intentional. Use packet filters for ordinary searching.