About Arkime MCP Server
Arkime MCP Server is an MCP server in the Healthcare category: mCP server for Arkime full packet capture — session search, network investigation, and capture health.
Install
git clone https://github.com/swannman/arkime-mcp-serverThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (13)
capture_statusArkime cluster health — node count, shard status, OpenSearch version
Parameters not published.
connections_graphNetwork connection graph — nodes and links with byte/packet/session counts
Parameters not published.
dns_lookupsDNS queries captured in traffic, filterable by domain pattern or source IP
Parameters not published.
external_connectionsSessions going to non-RFC1918 destinations, sorted by bytes
Parameters not published.
geo_summaryDestination traffic breakdown by country
Parameters not published.
get_session_detailFull decoded protocol detail for a single session
Parameters not published.
get_session_packetsDecoded packet data for a session
Parameters not published.
list_fieldsAvailable Arkime session fields for use in search expressions
Parameters not published.
pcap_filesPCAP capture files with sizes, packet counts, and time ranges
Parameters not published.
reverse_dnsPTR/reverse DNS lookup for an IP
Parameters not published.
Show all 13 tools
search_sessionsSearch sessions with Arkime expressions, returns source/dest IPs, ports, protocols, bytes, geo, and AS info
Parameters not published.
top_talkersTop N values for any field by session count (hosts, ports, domains, etc.)
Parameters not published.
unique_destinationsDistinct external IPs contacted by an internal host
Parameters not published.
Ask AI
Ask AI about Arkime MCP Server
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.