网络流量分析MCP服务器

# Maximum capture duration (seconds)
MAX_CAPTURE_DURATION=60

# Maximum file size for captures (bytes)
MAX_CAPTURE_SIZE=104857600  # 100MB

# Maximum output size (bytes)
MAX_OUTPUT_SIZE=1048576  # 1MB

# Enable rate limiting
RATE_LIMIT_ENABLED=true

# Max requests per window
RATE_LIMIT_MAX=5

# Time window in milliseconds
RATE_LIMIT_WINDOW_MS=60000  # 1 minute

# Max concurrent captures
MAX_CONCURRENT_CAPTURES=3

# Allowed network interfaces (comma-separated, empty = all)
ALLOWED_INTERFACES=en0,eth0

# Default interface
DEFAULT_INTERFACE=en0

# Allowed directories for PCAP files (comma-separated)
ALLOWED_PCAP_DIRS=/tmp/wiremcp,/home/user/wiremcp/pcaps

# Temporary directory
TEMP_DIR=/tmp/wiremcp

# Enable audit logging
AUDIT_ENABLED=true

# Audit log file path
AUDIT_LOG_FILE=/tmp/wiremcp-audit.log

# Enable credential extraction (USE WITH CAUTION)
ENABLE_CREDENTIAL_EXTRACTION=false

# Enable data sanitization
SANITIZE_DATA=true

{
  "mcpServers": {
    "wiremcp-secure": {
      "command": "node",
      "args": [
        "/absolute/path/to/WireMCP-Secure/index.js"
      ],
      "env": {
        "NODE_ENV": "production",
        "RATE_LIMIT_ENABLED": "true",
        "AUDIT_ENABLED": "true"
      }
    }
  }
}

{
  "mcpServers": {
    "wiremcp-secure": {
      "command": "node",
      "args": [
        "/absolute/path/to/WireMCP-Secure/index.js"
      ]
    }
  }
}

# Start the server
node index.js

# The server communicates via stdio, so you'll need an MCP client
# For testing, use the MCP Inspector or a compatible client

// Using capture_packets tool
{
  "interface": "en0",
  "duration": 10
}

// Using check_ip_threats tool
{
  "ip": "192.168.1.100"
}

// Using analyze_pcap tool
{
  "pcapPath": "/tmp/wiremcp/capture.pcap",
  "includeUrls": true,
  "includeProtocols": true
}

// Using get_status tool
{}  // No parameters needed

┌─────────────────┐
│   MCP Client    │
│  (Trusted LLM)  │
└────────┬────────┘
         │ stdio
┌────────▼────────┐
│  WireMCP Secure │
│  (Unprivileged) │
└────────┬────────┘
         │ IPC/Socket
┌────────▼────────┐
│ Capture Service │
│  (Privileged)   │
│  Isolated VLAN  │
└─────────────────┘

{
  "timestamp": "2025-12-13T10:30:45.123Z",
  "action": "TOOL_EXECUTION",
  "resource": "capture_packets",
  "userId": "client-abc123",
  "severity": "info",
  "details": {
    "arguments": {"interface": "en0", "duration": 5},
    "durationMs": 5234,
    "success": true
  },
  "pid": 12345
}

# Watch audit log in real-time
tail -f /tmp/wiremcp-audit.log | jq .

# Count operations by type
cat /tmp/wiremcp-audit.log | jq -r .action | sort | uniq -c

# Find all security events
cat /tmp/wiremcp-audit.log | jq 'select(.action=="SECURITY_EVENT")'

# Find rate limit violations
cat /tmp/wiremcp-audit.log | jq 'select(.action=="RATE_LIMIT_VIOLATION")'

# Check if tshark is installed
which tshark

# If not installed, install Wireshark
# macOS
brew install wireshark

# Linux
sudo apt-get install tshark

# Check permissions
ls -l $(which tshark)

# Grant capabilities (Linux)
sudo setcap cap_net_raw,cap_net_admin=eip $(which tshark)

# Or run as root (not recommended for production)
sudo node index.js

# Check current status
# Use the get_status tool to see rate limit status

# Adjust limits in .env
RATE_LIMIT_MAX=10  # Increase limit

# Ensure PCAP file is in allowed directory
# Check ALLOWED_PCAP_DIRS setting

# Create allowed directory
mkdir -p ~/wiremcp/pcaps

# Reduce output size limit
MAX_OUTPUT_SIZE=524288  # 512KB

# Reduce capture duration
MAX_CAPTURE_DURATION=30  # 30 seconds

# Check for vulnerable dependencies
npm audit

# Check for outdated packages
npm outdated

# Run linter with security rules
npx eslint . --ext .js

# Test with short capture
# In your MCP client:
# capture_packets(interface="en0", duration=5)

# Test rate limiting
# Make 6 requests quickly - 6th should fail

# Test path validation
# Try to analyze a file outside allowed directories - should fail

# Test input validation
# Try invalid interface name "en0; rm -rf /" - should fail

{
  "interface": "en0",
  "duration": 10
}