Command Line & MCP

PCAPAI Desktop 1.0.24 and later · macOS, Windows and Linux

PCAPAI is scriptable. Every install includes pcapai, the command-line analyzer, and pcapai-mcp, a Model Context Protocol server that lets Claude Desktop — or any MCP client — drive PCAPAI directly. Same engine as the app: the same dissectors, the same Wi-Fi health checks, the same NetInsights inventory.

Full reference

Every command, tool and route, generated from the shipped binaries rather than written by hand — so it cannot drift from what your install actually does:

The same three guides are in the app under Help, so you can read them either way — you should not need to launch a GUI to find out what the command line does.

Where the tools are after installing

Platformpcapaipcapai-mcpOn your PATH?
macOS /Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai …/Contents/MacOS/pcapai-mcp No — see below
Linux /usr/bin/pcapai /usr/bin/pcapai-mcp Yes
Windows beside the app in %ProgramFiles%\PCAPAI Desktop\ same directory Yes, unless you opted out during install

macOS needs one extra step. A drag-install DMG cannot write outside /Applications, so there is no automatic PATH entry. Link it once:

sudo ln -sf "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai" /usr/local/bin/pcapai
sudo ln -sf "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp" /usr/local/bin/pcapai-mcp

Windows: the installer adds the app directory to the machine PATH as an opt-out task. If you cleared that checkbox, call the full path or add it yourself.

Quickstart — the command line

pcapai --version
pcapai convert --input capture.pcapng --output capture.pcapai    # convert once, query many times
pcapai analyze --input capture.pcapng --format summary           # Wi-Fi health, protocols, timeline
pcapai analyze-bundle capture.pcapai                             # the whole analysis as one JSON object
pcapai filter --input capture.pcapng --output beacons.pcapng \
              --filter "wlan.fc.type_subtype == 8"
pcapai export --input capture.pcapai --output out.pcapng --format pcapng
pcapai --help                                                    # 21 command groups, 151 verbs

analyze-bundle is the single call to reach for from a script — one JSON object with the health report, capture summary, protocol hierarchy, timeline and mDNS services — and the only one of these that takes its input positionally. The rest take --input.

Copy the flags exactly. filter --output infers the format from the extension, so --output x.pcapai fails with "Cannot infer export format" — write .pcapng.

pcapai --version reports the release channel alongside the version, so you can tell a shipped build from a release candidate:

pcapai 1.0.25 (stable)

Quickstart — the MCP server

pcapai-mcp speaks JSON-RPC over stdio and exposes 98 tools. Add it to your MCP client's config — for Claude Desktop, in claude_desktop_config.json:

{
  "mcpServers": {
    "pcapai": {
      "command": "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp"
    }
  }
}

(Linux: /usr/bin/pcapai-mcp. Windows: the full path to pcapai-mcp.exe.)

Then ask your assistant to open a capture and go. It gets the same tools the app's own AI uses — packet queries, display filters, Wi-Fi security and handshake analysis, DNS analysis, the protocol hierarchy, the timeline, and read access to a NetInsights workspace.

Two deliberate limits