MCP Server
CloudShark Enterprise includes an MCP server that gives your AI agent access to your CloudShark repository. Your agent can search every capture your team has stored, read packets, Zeek logs, and Suricata alerts, and write its findings on the packets that prove them.
CloudShark does not have AI built in. It doesn’t include or host a model, and it doesn’t analyze captures or draw conclusions on its own. The MCP server gives your agent tools for reading and annotating captures. Your agent decides which tools to call and what the results mean.
There is nothing to install. The MCP server runs on your CloudShark system, and your agent connects to it over HTTP using the Model Context Protocol (MCP). It works with hosted and local models. To get started, see Connecting Your Agent.
What Your Agent Can Do
The MCP server gives your agent a set of tools. Each tool needs MCP Access on the token plus the token permission listed here, and only reaches captures the token’s user can see.
| Tool | What it does | Token permission |
|---|---|---|
list_captures |
Find captures by filename, tags, user, group, and date. | Search for files |
capture_info |
Read a capture’s details. | Get Info/Annotations |
deep_search, deep_search_status |
Search every capture for packets matching a display filter. | Deep Search |
packet_query |
Read chosen fields from the packets matching a display filter. | PCAP analysis |
packet_decode |
Read the full dissection of one packet. | PCAP analysis |
protocol_hierarchy |
Summarize the protocols in a capture. | PCAP analysis |
follow_stream |
Read the reassembled contents of a conversation, like Wireshark’s Follow Stream. | PCAP analysis |
zeek_logs, zeek_query |
List Zeek logs and run grouping queries against them. | PCAP analysis |
alerts_summary, alerts_list |
Read the ranked Suricata alert summary and the alerts behind it. | PCAP analysis |
list_annotations |
Read the annotations on a capture’s packets. | Get Info/Annotations |
annotate_packet |
Write an annotation on a packet. | Annotate packets |
The Zeek and Suricata tools return the same data as the Zeek API and Suricata API.
Some questions to try:
- “Find captures from this week with DNS failures to 10.0.0.53 and tell me what they have in common.”
- “This DHCP NAK pattern showed up today. Have we seen it in other captures from this site? Annotate the first occurrence in each.”
- “This Suricata alert fired on yesterday’s capture. Look at the packets and tell me if it’s real.”
Annotations
Annotations are the only thing your agent can change. It cannot upload, modify, or delete captures.
Every annotation written through the MCP server starts with MCP:, so anyone
looking at the capture can tell it came from an agent rather than an analyst. The
annotation appears under the name of the user the token belongs to.
Writing an annotation needs the Annotate packets permission and write access to the capture. A packet holds one annotation, so your agent will not overwrite an existing one unless it is told to, and it never removes annotations.
Your Data
The MCP server sends capture data to whichever agent connects to it, and that agent sends it on to wherever its model runs. If you use a hosted model, your packet data goes to that provider under your existing agreement with them. If you use a local model, the data stays on your network.
Administrators can see what left the system in the MCP audit log. See MCP Administration.
