MCP 服务器

arkime-mcp-server

An MCP server for Arkime full packet capture that enables AI assistants to search network sessions, investigate traffic patterns, and monitor capture health through various network analysis tools.

README

arkime-mcp-server

An MCP server for Arkime full packet capture. Lets AI assistants search network sessions, investigate traffic patterns, and monitor capture health.

Tools

Tool	Description
`search_sessions`	Search sessions with Arkime expressions, returns source/dest IPs, ports, protocols, bytes, geo, and AS info
`get_session_detail`	Full decoded protocol detail for a single session
`get_session_packets`	Decoded packet data for a session
`top_talkers`	Top N values for any field by session count (hosts, ports, domains, etc.)
`connections_graph`	Network connection graph — nodes and links with byte/packet/session counts
`unique_destinations`	Distinct external IPs contacted by an internal host
`dns_lookups`	DNS queries captured in traffic, filterable by domain pattern or source IP
`reverse_dns`	PTR/reverse DNS lookup for an IP
`external_connections`	Sessions going to non-RFC1918 destinations, sorted by bytes
`geo_summary`	Destination traffic breakdown by country
`capture_status`	Arkime cluster health — node count, shard status, OpenSearch version
`pcap_files`	PCAP capture files with sizes, packet counts, and time ranges
`list_fields`	Available Arkime session fields for use in search expressions

Setup

npm install
npm run build

Configuration

Set environment variables:

Variable	Required	Default	Description
`ARKIME_URL`	No	`http://192.168.5.176:8005`	Arkime viewer URL
`ARKIME_USER`	No	`mcp`	Arkime API username
`ARKIME_PASSWORD`	Yes	—	Arkime API password

Usage with Claude Code

Add to your MCP settings (e.g., .mcp.json):

{
  "mcpServers": {
    "arkime": {
      "command": "node",
      "args": ["/path/to/arkime-mcp-server/build/index.js"],
      "env": {
        "ARKIME_PASSWORD": "your-password"
      }
    }
  }
}