Command Line & MCP

Documentation version: 1.0.34. Generated from the release source and checked against the built command-line and MCP binaries.

PCAPAI Desktop · macOS, Windows and Linux

PCAPAI is scriptable. Every install includes pcapai, the command-line analyzer, and pcapai-mcp, a Model Context Protocol server that lets Claude Desktop — or any MCP client — drive PCAPAI directly. Same engine as the app: the same dissectors, the same Wi-Fi health checks, the same NetInsights inventory.

Full reference

Reference snapshots for 1.0.34 commands, tools and routes. Check your installed version with pcapai --version:

The same three guides are in the app under Help, so you can read them either way — you should not need to launch a GUI to find out what the command line does.

Where the tools are after installing

Platformpcapaipcapai-mcpOn your PATH?
macOS /Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai …/Contents/MacOS/pcapai-mcp No — see below
Linux /usr/bin/pcapai /usr/bin/pcapai-mcp Yes
Windows beside the app in %ProgramFiles%\PCAPAI Desktop\ same directory Yes, unless you opted out during install

macOS needs one extra step. A drag-install DMG cannot write outside /Applications, so there is no automatic PATH entry. Link it once:

sudo ln -sf "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai" /usr/local/bin/pcapai
sudo ln -sf "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp" /usr/local/bin/pcapai-mcp

Windows: the installer adds the app directory to the machine PATH as an opt-out task. If you cleared that checkbox, call the full path or add it yourself.

Quickstart — the command line

pcapai --version
pcapai convert --input capture.pcapng --output capture.pcapai    # convert once, query many times
pcapai analyze --input capture.pcapng --format summary           # Wi-Fi health, protocols, timeline
pcapai analyze-bundle capture.pcapai                             # the whole analysis as one JSON object
pcapai filter --input capture.pcapng --output beacons.pcapng \
              --filter "wlan.fc.type_subtype == 8"
pcapai export --input capture.pcapai --output out.pcapng --format pcapng
pcapai --help                                                    # 35 command groups, 252 verbs

analyze-bundle is the single call to reach for from a script — one JSON object with the health report, capture summary, protocol hierarchy, timeline and mDNS services — and the only one of these that takes its input positionally. The rest take --input.

Copy the flags exactly. filter --output infers the format from the extension, so --output x.pcapai fails with "Cannot infer export format" — write .pcapng.

pcapai --version reports the release channel alongside the version, so you can tell a shipped build from a release candidate:

pcapai 1.0.34 (stable)

Quickstart — the MCP server

pcapai-mcp speaks JSON-RPC over stdio and exposes 126 tools. With Claude Code, one command adds it:

claude mcp add pcapai -- "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp"

For Claude Desktop, add it to claude_desktop_config.json:

{
  "mcpServers": {
    "pcapai": {
      "command": "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp"
    }
  }
}

(Linux: /usr/bin/pcapai-mcp. Windows: the full path to pcapai-mcp.exe.)

Then ask your assistant to open a capture and go. It gets the same tools the app's own AI uses — packet queries, display filters, Wi-Fi security and handshake analysis, DNS analysis, the protocol hierarchy, the timeline, and read access to a NetInsights workspace.

It can also run read-only diagnostics on your saved devices, on macOS and Linux. ssh_exec and fleet_run_command run one command on one device, fleet_run_runbook starts a read-only run on up to 100 devices, and snmp_get, snmp_walk and snmp_diff read SNMP through a saved profile. These tools reach only devices you have saved in the app's SSH Manager, and log in with the login profiles assigned to each device there; an assistant cannot point a credential at a device it was not assigned. fleet_list_devices, fleet_get_device and fleet_get_run_results read the inventory and past results.

Deliberate limits