PcapLM MCP Connector

Ask Claude about your network captures directly — no web app tab needed.

What it is

PcapLM exposes a remote MCP server (Streamable HTTP transport) at:

https://pcaplm.com/mcp/

Connect it to Claude.ai, Claude Desktop, or Cowork and Claude can list your captures, pull detection findings, query connections/DNS/HTTP, and ask PcapLM's analyst roles questions — all scoped to captures your account owns. Available on Pro and Team plans.

Connect with OAuth (recommended)

In Claude: Settings → Connectors → Add custom connector (on Claude Team/Enterprise, an org Owner adds it under Organization settings first).
URL: https://pcaplm.com/mcp/ — leave the advanced OAuth fields empty.
Click Connect, log in at pcaplm.com, and click Approve.
Enable the connector in a chat and try: "Show me the findings for my latest capture."

Under the hood: OAuth 2.1 authorization-code grant with PKCE, dynamic client registration, and standard discovery metadata. Access tokens last 1 hour and refresh automatically; refresh tokens rotate on every use.

Connect with a static API key

For scripts and MCP clients that don't drive OAuth: log in at pcaplm.com, go to Account → MCP Plugin, create a key (shown once), and configure your client with URL https://pcaplm.com/mcp/ and the key as a Bearer token. Revoke keys any time from the same page.

Available tools

All analysis tools are read-only. The only write is create_upload, which adds a new capture to your own account — the connector can never modify or delete anything.

Tool	What it does
`list_captures`	Lists your captures (id, filename, status, upload time).
`create_upload`	Mints a single-use upload URL (expires in 15 minutes) so an agent with local file access — Claude Cowork, Claude Desktop, Claude Code — can send a pcap from the current session straight into your account, then analyze it once processing finishes.
`get_capture_summary`	Top talkers, protocol mix, timeline, finding counts for one capture.
`get_findings`	Detection-engine findings, optionally filtered by rule or severity.
`query_connections`	Connection rows, filterable by src/dst IP, protocol, min bytes. Capped at 200 rows.
`query_dns`	DNS query rows, filterable by substring or source IP. Capped at 200 rows.
`query_http`	HTTP request rows, filterable by host substring or Basic-auth presence. Capped at 200 rows.
`query_flow_features`	Per-flow statistical feature vectors (packet-length & inter-arrival min/max/mean/std, rates, TCP flag counts, forward/backward/whole-flow) for ML-style analysis. Capped at 200 rows.
`run_role`	Asks PcapLM's orchestrator a question; it routes to the right specialist role (Analyst, Hunter, Writer, Teacher, Builder, or Briefer) and answers using the tools above.

Security & data

Every tool call is scoped to captures your account owns — another account's capture ID returns an error, never their data.
Credentials are stored hashed; OAuth tokens expire and rotate.
Plan gating (Pro/Team) is enforced on every request.
See the Privacy Policy for what data is processed and how.

Troubleshooting

401 "Invalid, expired, or revoked credentials" — for OAuth, disconnect and reconnect the connector; for API keys, create a new one.
403 "requires a Pro or Team plan" — upgrade at pcaplm.com/pricing.html.
Capture not found — it doesn't exist or belongs to a different account than the one you authorized.
"Capture is not ready yet" — processing is still running; check list_captures for status: "ready".
401 "Invalid, expired, or already-used upload token" — upload URLs from create_upload are single-use and expire after 15 minutes; ask the agent to mint a fresh one and retry.
Still stuck? support@pcaplm.com