About Malshark
Malshark is an MCP server in the Security category: aI-powered malware traffic analysis and network forensics via the Model Context Protocol.
Install
From source
git clone https://github.com/MohitDabas/malsharkThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (9)
c2_beaconingBurst-cluster timing analysis on a specific IP — computes mean/median interval, jitter coefficient, and gives a confidence verdict
Parameters not published.
capture_packetsLive packet capture from a network interface
Parameters not published.
detect_dns_tunnelingEntropy analysis, query length distribution, label count — scores potential DNS tunneling channels
Parameters not published.
extract_credentialsCleartext credentials (Basic auth, form POST, FTP, SMTP, Telnet) + malware-specific custom auth headers (e.g. `user:`, `BuildID:`) sent to bare-IP C2s
Parameters not published.
extract_iocs6 parallel tshark passes → DNS queries, TLS SNI, HTTP requests/responses, **C2-on-443** (non-TLS traffic on port 443), **unreachable C2** (SYN-only), suspicious user agents
Parameters not published.
find_downloadsDetects file downloads (HTTP) and large exfil uploads; HTTPS large-transfer estimates for encrypted payloads ≥ 1 MB
Parameters not published.
http_sessionsFull HTTP request/response pairs with cloud C2 pattern detection (Telegram Bot API, Discord/Slack webhooks, suspicious UA to whitelisted cloud domains)
Parameters not published.
list_interfacesList available capture interfaces
Parameters not published.
pcap_summaryHigh-level overview: duration, packets, victim IP, top IPs by bytes, protocol breakdown, red flags
Parameters not published.
Ask AI
✦
Ask AI about Malshark
Powered by Claude · Grounded in docs
I know everything about Malshark. Ask me about installation, configuration, usage, or troubleshooting.
Security checks
6 checks have not been run yet.