pcapai-mcp speaks JSON-RPC over stdio. Point your MCP client at the binary:
| Platform | Path |
|---|---|
| macOS | /Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp |
| Linux | /usr/bin/pcapai-mcp |
| Windows | %ProgramFiles%\PCAPAI Desktop\pcapai-mcp.exe |
Claude Code:
claude mcp add pcapai -- "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp"Claude Desktop, in claude_desktop_config.json:
{
"mcpServers": {
"pcapai": {
"command": "/Applications/PCAPAI Desktop.app/Contents/MacOS/pcapai-mcp"
}
}
}Add --file <capture> to open a capture at startup; otherwise call
open_file first.
ssh_exec and fleet_run_command run
one show-style command on one device, fleet_run_runbook starts a
read-only run on at most 100 devices, and snmp_get, snmp_walk and
snmp_diff read SNMP through a saved profile. Every command is checked before a
connection is opened; one that is not read-only is refused. There is no MCP write approval,
and SNMP SET and RESTCONF are not MCP tools. To change a configuration, use
pcapai fleet run <runbook> --approve-writes or the app. The SSH tools
are not in the Windows build yet.get_packet_notes, the planner_get_* tools,
planner_get_survey, netinsights_import_assist).Shipped on all three platforms from 1.0.24 (4b273161e). JSON-RPC over stdio. The four lifecycle tools (open_file, get_file_info, get_analysis_bundle, get_packet_list) are MCP-only; the rest are get_tool_definitions() minus MCP_EXCLUDED_TOOLS. The SSH device tools (ssh_exec, fleet_run_command, fleet_run_runbook) run read-only commands only, checked before any connection, with no MCP write approval, and are not in the Windows build; edit_packet_notes and planner_edit are excluded, so notes and the planner are read-only over MCP. Read-only is the tool's own annotations.readOnlyHint, not an editorial judgement.
| Tool | Read-only | What it does |
|---|---|---|
access_point_clients | yes | Get the clients associated with a PHYSICAL access point. |
analyze_block_ack_health | yes | Analyze Block Ack (BA) session health from the capture. |
analyze_handshakes | yes | Analyze WiFi 4-way handshakes: completion, timing, failures, PMKID. |
analyze_qos_flows | yes | Analyze SCS/MSCS QoS flow health from the capture. |
analyze_twt_health | yes | Analyze TWT (Target Wake Time) session health from the capture. |
analyze_wifi_security | yes | Analyze WiFi security threats: deauth attacks, rogue APs, weak encryption, evil twins. |
api_apply_mapping | no | Apply a proposed mapping (from api_propose_mapping), writing its mapped data into the workspace as PROVISIONA… |
api_describe_sandbox | yes | List API-sandbox items: connector responses/requests the engine could NOT fit into the canonical schema (an u… |
api_get_capabilities | yes | Report one connector's capability matrix: which data types it can READ (device, interface, wlan, client, topo… |
api_get_diagnostics | yes | Export the redacted API-sandbox diagnostics bundle: every staged adaptation (raw redacted response + inferred… |
api_list_connectors | yes | List the API connectors configured in the active workspace (read-only). |
api_propose_mapping | no | Propose a field mapping for a sandbox staging item (from api_describe_sandbox). |
apply_filter | no | Apply a Wireshark display filter to narrow down packets for analysis. |
carrier_lookup | yes | Carrier & Identity lookups, offline (embedded tables, no network). |
compare_values | yes | Compare field values between groups (set operations). |
correlate_fields | yes | Correlate multiple metrics grouped by a field. |
count_by_field | yes | Count packets grouped by field value (fast GROUP BY). |
detect_patterns | yes | Detect common Wi-Fi patterns: high_retry_clients and weak_signal_clients return the clients past a threshold;… |
dns_lookup | yes | Active DNS lookup through THIS machine's resolver (not from a capture; use get_dns_* for that). |
extract_fields | yes | Extract field values from every packet in the current scope (apply a filter first to scope it). |
field_time_series | yes | Get time series data for a field (like Wireshark IO Graph). |
fleet_get_device | yes | Read one fleet device by id, host/IP, or name — full enrichment, tags, notes, prompt override, and its effect… |
fleet_get_run_results | yes | Read fleet run results: run summary with per-status counts plus paged per-device rows, or — when 'device' is… |
fleet_list_devices | yes | Read-only paged search of the fleet device inventory (the devices imported into PCAPAI's Fleet window — IPs/h… |
fleet_list_runbooks | yes | List saved fleet runbooks (name, description, last updated). |
fleet_plan_upgrade | yes | Plan a FIRMWARE UPGRADE of one fleet device (Ruckus ICX / FastIron) WITHOUT running it: builds the runbook (s… |
fleet_run_command | no | Run ONE read-only diagnostic command over SSH against a single fleet device (show/display/get/ip/iw/ping/etc). |
fleet_run_runbook | no | Start a READ-ONLY fleet run over SSH against at most 100 devices. |
fleet_validate_runbook | yes | Validate fleet runbook YAML WITHOUT running it: structural rules, Rhai expression compilation, variable refer… |
geolocate_ip | yes | Resolve up to 25 IP addresses to an approximate geographic location and ASN/owner. |
get_airtime_breakdown | yes | Per-radio Wi-Fi airtime attribution: WHO (which stations) and WHAT (which frame types / traffic) is burning t… |
get_analysis_bundle | yes | Get the full stable analysis bundle for the loaded capture as one JSON object: aggregate Wi-Fi health report… |
get_burst_periods | yes | Get detected traffic burst periods. Returns periods of unusually high traffic with start/end times, peak/aver… |
get_capture_quality | yes | Get capture quality assessment: FCS error rate, truncation rate, and malformed packet classification (capture… |
get_client_detail | yes | Get detailed analysis of a specific Wi-Fi client including authentication timeline, join sessions (auth/assoc… |
get_device_specs | yes | Look up VERIFIED specifications for a catalogued access point, switch, or wireless controller from the bundle… |
get_dns_health | yes | DNS health report: capture visibility, graded checks (latency, errors, timeouts, retries, slow-resolver QoE,… |
get_dns_security | yes | DNS security findings sorted by severity: rogue servers, tunneling, cache poisoning, LLMNR/NBNS/WPAD poisonin… |
get_dns_servers | yes | Per-DNS-server stats: query/response/timeout counts, latency percentiles, and classification (expected/public… |
get_dns_sites | yes | DNS site/domain inventory rolled up to registrable domain (eTLD+1): per-site query/answered/NXDOMAIN counts a… |
get_dns_summary | yes | Use this for DNS questions. Capture-wide DNS totals (queries/responses/matched/timeouts/orphans/retransmissio… |
get_file_info | yes | Get summary information about the currently loaded capture file: packet count, file path, link type, and whet… |
get_mdns_services | yes | Get mDNS/Bonjour services discovered in the capture. |
get_packet_list | yes | Get a summary list of packets showing columns: No, Time, Source, Destination, Protocol, Length, Info. |
get_packet_notes | yes | Read the Wireshark-style notes and capture provenance persisted in the open capture: the capture-level commen… |
get_passpoint_providers | yes | Returns the capture's pre-parsed Passpoint / Hotspot 2.0 (ANQP) data: domain names, NAI realms, 3GPP PLMNs, o… |
get_ping_monitor_data | yes | Read THIS machine's desktop Ping Monitor history — the continuous reachability/latency/jitter/loss monitoring… |
get_protocol_hierarchy | yes | Get the protocol hierarchy breakdown from pre-computed analysis. |
get_protocol_tree | yes | Get the dissected protocol tree for one packet — the way to read a specific packet's field values. |
get_service_details | yes | Read complete persisted service observations, including protocol headers/options and evidence frame IDs. |
get_service_summary | yes | Network-scoped DNS, DHCPv4, DHCPv6, router advertisement and captive portal inventory with complete persisted… |
get_statistics | yes | Compute packet statistics by scanning packets: protocol breakdown, timeline, or conversation analysis (large… |
get_timeline_data | yes | Get traffic timeline data showing packet rates over time. |
get_unique_packets | yes | Get unique values for a field with counts. |
get_wlan_context | yes | Get relationship-aware WLAN context for troubleshooting. |
list_access_points | yes | List all Wi-Fi Access Points visible in the capture. |
list_clients | yes | List all Wi-Fi Clients visible in the capture. |
my_ip | yes | This machine's network identity. LOCAL (always, sends nothing): interfaces that are up (all_interfaces=true a… |
netinsights_area_aps | yes | Read-only. Resolve a free-text AREA NAME ("the media tribune", "north concourse", "suite 12") to the set of a… |
netinsights_area_vocabulary | yes | Read-only. List every name this workspace's OWN data uses for a place — controller policy/site/RF tags, uplin… |
netinsights_cellular_layers | yes | Read-only. The workspace's cellular coverage and cell tower layers: FCC filed coverage per carrier (hexes cou… |
netinsights_client_auth_events | yes | Read-only NetInsights per-client AAA / join events with the per-WLAN AAA-path verdict, from an imported Smart… |
netinsights_diff_configs | yes | Read-only comparison of two NetInsights config snapshots. |
netinsights_get_config_drift | yes | Read-only NetInsights config drift report for one device. |
netinsights_get_config_history | yes | Read-only paged list of NetInsights redacted config snapshots. |
netinsights_get_data_quality | yes | Read-only NetInsights data-quality report — WHY the inventory is incomplete. |
netinsights_get_device_detail | yes | Read-only NetInsights device detail lookup. |
netinsights_get_device_evidence | yes | Read-only NetInsights evidence bundle for one device. |
netinsights_get_evidence_snippet | yes | Read-only bounded redacted source snippet around one NetInsights parser observation. |
netinsights_get_health_checks | yes | Read-only paged NetInsights health-check report — the findings themselves. |
netinsights_get_infra_health | yes | Read-only NetInsights Infra Health run — the IC (configuration), IL (device log) and IB (baseline drift) chec… |
netinsights_get_topology_neighborhood | yes | DEPRECATED alias of netinsights_topology_graph, removed after 1.0.33; call netinsights_topology_graph ins… |
netinsights_get_topology_path | yes | DEPRECATED alias of netinsights_topology_path, removed after 1.0.33; call netinsights_topology_path inste… |
netinsights_get_troubleshooting_brief | yes | Read-only evidence-backed NetInsights troubleshooting brief for one device. |
netinsights_get_vlan_subnet_catalog | yes | Read-only paged NetInsights VLAN and subnet catalog query with canonical network derivation. |
netinsights_import_assist | yes | Help import TRICKY config/backup files into NetInsights. |
netinsights_prepare_ai_extraction | yes | Read-only NetInsights AI extraction preparation. |
netinsights_refresh_sources | no | Pull (sync) the workspace's configured sources NOW: re-reads Ruckus One / SmartZone over their APIs, collects… |
netinsights_rf_proximity | yes | Read-only. Ask whether this workspace's RF-neighbour data can support a PHYSICAL PROXIMITY claim at all, and… |
netinsights_search_devices | yes | Read-only paged search of NetInsights current device inventory. |
netinsights_search_evidence | yes | Read-only paged search of NetInsights current fact evidence with source artifact provenance. |
netinsights_search_services | yes | Read-only paged NetInsights service inventory query. |
netinsights_search_topology_edges | yes | Read-only paged search of NetInsights current topology edges. |
netinsights_search_topology_evidence | yes | DEPRECATED alias of netinsights_topology_edge_evidence, removed after 1.0.33; call `netinsights_topology_ed… |
netinsights_sources | yes | Read-only. Where this NetInsights workspace's data comes from and how fresh it is: each source (Ruckus One or… |
netinsights_topology_edge_evidence | yes | Read-only paged supporting/conflicting/missing protocol evidence for NetInsights topology edges (LLDP/CDP/MAC… |
netinsights_topology_graph | yes | Read-only NetInsights topology view. mode=graph (default): the scoped topology graph — device nodes, placehol… |
netinsights_topology_path | yes | Read-only NetInsights shortest path between two devices over resolved topology edges, for path and flow quest… |
netinsights_triage_workspace | yes | Read-only NetInsights workspace triage. Call this first for broad questions like 'what is wrong', 'any proble… |
netinsights_wireless_clients | yes | Read-only Cisco C9800 client data from an imported show-tech: the aggregate client counts (total clients, 802… |
netinsights_wlan_coverage | yes | Read-only Cisco C9800 WLAN coverage: which APs broadcast a given SSID, or which SSIDs and VLANs a policy tag… |
netinsights_workspace_status | yes | Read-only NetInsights workspace identity and size. |
open_file | yes | Open a packet capture file (.pcapai, .pcap, or .pcapng). |
oui_lookup | yes | Look up the vendor for MAC addresses or OUI prefixes in the embedded IEEE registry (offline, no network). |
passive_dns_lookup | yes | Resolve an IP to its best passive-DNS name (built from this capture, no live lookups), or a hostname to the I… |
ping_run | no | Ping ONE host with a bounded number of probes and return every probe plus rtt/loss/jitter statistics. |
planner_export_coverage | yes | The WHOLE design's coverage report as a finished document — markdown or CSV — the same one the desktop writes… |
planner_export_readiness | yes | Whether this design can be exported as an installer FIELD PACK (the .svg/.pdf/.drawio walk-sheet set), floor… |
planner_get_bom | yes | Bill of materials and PoE budget analysis for the Wi-Fi Planner project: AP/switch inventory with model-match… |
planner_get_calibration | yes | Compare MEASURED survey RSSI against the propagation model's PREDICTION at the same positions, for one floor… |
planner_get_coverage | yes | Computed coverage STATISTICS for one Planner floor and band: percentage of the floor at or above -65 dBm and… |
planner_get_linework | yes | Read extracted drawing candidates, including thin partitions and furniture. |
planner_get_materials | yes | The Planner project's wall-material catalog: each material's name, flat attenuation in dB per crossing, dB pe… |
planner_get_project | yes | Summarize the open Wi-Fi Planner (RF design) project: floors (name, dimensions in meters, whether scale is se… |
planner_get_rf_inputs | yes | RF propagation INPUTS for one floor and band: floor bounds, each client-serving AP's tx power / channel / pos… |
planner_get_rf_models | yes | Per-AP report of WHICH antenna model the RF math is actually using on a band, and why. |
planner_get_survey | yes | Survey walks recorded in the Planner project. |
planner_list_aps | yes | List the access points in the Wi-Fi Planner project. |
planner_match_survey_aps | yes | Propose which DESIGN AP each SURVEYED (measured) AP in the Planner project is, on an evidence ladder: an infr… |
port_scan | no | TCP Connect() port scan (no root, no raw sockets) of EXPLICIT targets: addresses, CIDRs, ranges (10.0.0.10-20… |
search_device_catalog | yes | Browse/search the bundled device + antenna catalogue (121 devices — APs, switches, wireless controllers — and… |
search_fields | yes | Search for valid Wireshark field names. Use this to verify field names before using them in filters or extrac… |
snmp_diff | no | Walk the same subtree on two saved profiles and compare: objects on A only, on B only, and objects whose type… |
snmp_get | no | SNMP GET (or GETNEXT with next=true) of up to 64 OIDs on ONE device, through a saved profile (v1, v2c or v3 a… |
snmp_profiles | yes | List the saved SNMP profiles (name, host, port, version, v3 user, security level and protocol NAMES). |
snmp_walk | no | Walk one subtree on ONE device through a saved profile (GETBULK, or GETNEXT for v1). |
ssh_exec | no | Run ONE read-only command on ONE saved fleet device over SSH and get {stdout, stderr, exit_code, status, dura… |
subnet_calc | yes | IPv4 subnet calculator (offline, no network). |
syslog_drill_template | yes | Drill into a specific syslog template. Returns full template details, all matching events, and unique variabl… |
syslog_get_sources | yes | Get all syslog source device summaries. Returns source IP, hostname, vendor, message/error/warning counts for… |
syslog_get_templates | yes | Get syslog log templates (message patterns) from the loaded syslog analysis. |
syslog_get_timeline | yes | Get syslog event timeline grouped into time buckets. |
syslog_search_events | yes | Search syslog events (deduplicated aggregations of raw messages). |
throughput_run | no | Run an iperf3-protocol throughput test as a CLIENT against a server (a stock iperf3 server works) and return… |
traceroute_run | no | Trace the route to ONE host and return every hop (address, per-probe rtt, loss, segment, ASN/organisation whe… |
triage_capture | yes | PCAP-first capture triage. Call this first for broad questions like 'what is wrong', 'any problems', 'summari… |