Loading ToolBench
Professional-grade network analysis MCP server with Wireshark, Nmap, and threat intelligence
NetMCP has well-structured tool definitions with complete schemas and proper annotations. All 8 tools have descriptions (avg 95 chars), input schemas with typed parameters, and tool annotations (readOnlyHint, destructiveHint, idempotentHint). However, descriptions are terse (below the 194-char baseline for A+ tools), parameter descriptions lack actionable constraints (e.g., no format specs for filepath or display_filter), and error handling is generic ('NETMCP_004' codes without recovery guidance). Security validation is present (sanitize_filepath, validate_display_filter) but not documented in tool descriptions. Output schemas are partially documented but lack pagination guidance for list-like operations.
Convert a PCAP file between pcap and pcapng formats.
Decode a specific packet from a PCAP file with full protocol dissection.
Compare two PCAP files and report differences.
Export packet fields from a PCAP as CSV with proper headers using tshark -E flags.
Export packets from a PCAP file as structured JSON.
Get a quick packet summary similar to Wireshark's packet list view. Uses column fields (_ws.col.*) for human-readable output.
Merge multiple PCAP files into one using mergecap.
Parameter descriptions lack actionable constraints. 'filepath' and 'display_filter' have minimal guidance; no format specs, length limits, or examples of valid Wireshark filters. LLMs cannot infer valid filter syntax from 'Wireshark display filter'.
Error responses use opaque error codes ('NETMCP_004') without recovery guidance. LLMs cannot determine if an error is retryable, user-fixable, or fatal. No suggestions for next steps (e.g., 'Try a simpler display filter' or 'Check file permissions').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Slice or filter a PCAP file using editcap.
Output schemas not documented. Tools return dicts with 'filepath', 'packet_count', 'packets' but LLMs cannot see the structure of nested 'packets' array or field types. No pagination guidance for export_packets_json (max_packets=10000 could blow context window).
Tool descriptions are terse (avg 65 chars vs 194-char baseline). Missing context on WHEN to use each tool. E.g., 'get_packet_summary' vs 'export_packets_json', when should an LLM pick one over the other? No guidance on use cases or prerequisites.
Security validation (sanitize_filepath, validate_display_filter) is implemented but not documented in tool descriptions. LLMs cannot see that inputs are validated, risking unnecessary defensive prompting or misunderstanding of what inputs are safe.