mcp-server-traffic-inspectorBLOCK
专为 AI Agent 打造的网络流量抓包、会话检索、底层链路诊断、请求重放与规则 Mock 全功能 MCP Server (Full-stack Network Traffic Inspector MCP Server for AI Agents)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
专为 AI Agent / LLM 打造的网络流量抓包、会话检索、底层链路诊断、请求重放与规则 Mock 全功能 MCP Server
📖 项目简介
atengk-mcp-server-traffic-inspector 是一款工业级全栈网络流量巡检与抓包 Model Context Protocol (MCP) Server。采用 主控与受控子进程解耦架构,基于共享 SQLite WAL 数据总线连接应用层(L7 mitmproxy)与传输层(L3/L4 tshark),为 AI Agent 赋予完整的网络流量观测与排障闭环:
flowchart LR
A["AI Agent(Claude / Cursor / Antigravity)"] |"MCP 协议 (stdio / sse)"| B["FastMCP 主控进程(18 Tools 注册)"]
B |"数据查询 / 状态同步"| C[("共享 SQLite WAL数据总线")]
B -->|"受控子进程启停"| D["mitmdump (L7 HTTP/HTTPS)"]
B -->|"受控 CLI 执行"| E["tshark (L3/L4 PCAP)"]
D -->|"流式入库 / 分流落盘"| C
D |"热读取 Mock 规则"| C
E -->|"离线解析 / 实时抓包"| B✨ 核心特性
- 🌐 **应用
b9e088df4fa8OBSERVED · 2026-10-13Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add atengk-mcp-server-traffic-inspector -- uvx atengk-mcp-server-traffic-inspector
{
"mcpServers": {
"atengk-mcp-server-traffic-inspector": {
"command": "uvx",
"args": [
"atengk-mcp-server-traffic-inspector"
]
}
}
}Exposed tools (18)
12 read · 5 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_intercept_rule | write | 新增一条非阻塞动态拦截规则 (InterceptRule),支持 Mock 短路返回与 Header 动态改写。 |
analyze_http_traffic | read | 统计慢请求 Top 5、状态码分布、高频端点 Top 10 与总吞吐流量。 |
analyze_pcap_file | read | 调用 tshark 对离线 .pcap/.pcapng 报文执行协议分布、TCP 重传率与 DNS 深度分析。 |
clear_intercept_rules | destructive | 清空全部动态拦截规则,或按指定 rule_id 移除单条规则。 |
diagnose_network_session | read | 对 HTTP 流量或 PCAP 报文生成结构化健康度评分、异常项与根因诊断报告。 |
export_http_session | read | 将指定或最近一次抓包会话的全部流量与完整载荷导出为标准 HAR 1.2 归档文件。 |
get_ca_certificate | read | 获取 mitmproxy 本地 CA 根证书路径及 Windows/Linux 信任安装指引。 |
get_capture_status | read | 查询当前 HTTP 抓包代理运行状态、会话 ID、已捕获流数量与运行时长。 |
get_http_flow_detail | read | 查询单条 HttpFlow 的完整请求/响应头与截断预览 BodyPayload,支持导出完整载荷文件。 |
list_http_flows | read | 按多维条件分页检索已捕获的 HttpFlow 轻量元数据列表(不含 BodyPayload)。 |
list_intercept_rules | read | 查看当前配置的全部动态拦截与改写规则 (InterceptRule)。 |
list_network_interfaces | read | 枚举当前主机可用于抓包的网络接口列表。 |
replay_http_request | read | 基于已捕获的历史 HttpFlow 执行参数变异重放 (FlowReplay),并对比新旧响应差异。 |
start_http_capture | write | 启动受控 mitmdump 后台代理会话 (CaptureSession) 捕获 HTTP/HTTPS 流量。 |
start_pcap_capture | write | 在指定网卡上启动原始网络层数据包捕获 (PcapCapture),受双重熔断阈值保护。 |
stop_http_capture | write | 停止当前正在运行的 HTTP/HTTPS 抓包代理会话并返回捕获统计。 |
stop_pcap_capture | write | 停止当前正在运行的实时 PCAP 网卡抓包任务并返回数据包统计。 |
toggle_system_proxy | read | 开启或关闭操作系统全局代理(Windows 注册表托管;非 Windows 优雅降级指引)。 |
Trust audit
BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (13)
verify=False,
f'sudo cp "{target_pem}" /usr/local/share/ca-certificates/mitmproxy.crt',"sudo update-ca-certificates",
"sudo security add-trusted-cert -d -r trustRoot "
Path("/usr/local/bin/tshark"),clear_intercept_rules
streamable-http
.cliff.toml
"MCP_TRAFFIC_INSPECTOR_TSHARK_PATH": "/usr/local/bin/tshark",
assert cfg.tshark_path == "/usr/local/bin/tshark"
export http_proxy=http://127.0.0.1:8080
export https_proxy=http://127.0.0.1:8080
system use found in code, not declared in the description
Gates applied: no_behavioural_pass.
b9e088df4fa8full audit observations/trust-audit/mcp-server/atengk__mcp-server-traffic-inspector.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | b9e088df4fa8 | BLOCK | F | 59 | first audit |
Questions
What is the mcp-server-traffic-inspector MCP server?
专为 AI Agent 打造的网络流量抓包、会话检索、底层链路诊断、请求重放与规则 Mock 全功能 MCP Server (Full-stack Network Traffic Inspector MCP Server for AI Agents)
What tools does mcp-server-traffic-inspector expose?
18 in total: 12 read-only, 5 that write, and 1 that can delete or overwrite (clear_intercept_rules). Every one is listed on this page with its risk.
Is mcp-server-traffic-inspector safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (59/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does mcp-server-traffic-inspector need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-server-traffic-inspector run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as atengk-mcp-server-traffic-inspector.
How current is this page?
The grade is for one exact copy of the source (b9e088df4fa8), read on 2026-10-13. The repository is watched and re-audited when it changes.