NetPeek MCP: Let Claude or Codex Analyze iPhone Captures

Copy the current MCP URL and token from NetPeek. The in-app one-tap install prompt already carries the current address, token, and capability metadata and is the least error-prone option. For manual setup, pick one:

Option 1: Claude Code CLI

claude mcp add --transport http netpeek http://<PHONE_IP>:<PORT>/mcp \
  --header "Authorization: Bearer <PASTE_TOKEN_FROM_NETPEEK>"

Option 2: generic JSON config (Claude Desktop, Codex, Cursor, …)

Merge mcpServers.netpeek into the client configuration without replacing existing servers:

{
  "mcpServers": {
    "netpeek": {
      "type": "http",
      "url": "http://<PHONE_IP>:<PORT>/mcp",
      "headers": {
        "Authorization": "Bearer <PASTE_TOKEN_FROM_NETPEEK>"
      }
    }
  }
}

curl connectivity and authentication check

curl -H 'Authorization: Bearer <PASTE_TOKEN_FROM_NETPEEK>' http://<PHONE_IP>:<PORT>/mcp/health

After the health check succeeds, reload the MCP client and explicitly refresh tools/list, resources/list, and prompts/list.

Once connected, an AI client can call the tools below. Compact listings are redacted by default; full details, raw bodies, and configuration import all sit behind Bearer authentication.

NetPeek MCP also ships a catalog of analysis playbooks that clients supporting prompts/list can pick directly:

• traffic_triage— First-pass triage: top hosts, errors, slow endpoints, anomalies
• debug_api_failure— Locate a failing API by status/host/keyword and evidence its root cause
• privacy_audit— Find PII, credential leaks, weak TLS, unexpected third parties
• why_slow— Explain a slow request with the timing waterfall
• find_cleartext— Find cleartext traffic and certificate anomalies
• diff_captures— Compare two capture runs and summarize drift
• reverse_api— Draft an API schema for a target host
• explain_app_behavior— Explain the captured app's overall network behavior
• install_rewrite_bundle— Translate debugging intent into one validated rule import

Once connected, just ask your AI assistant in plain language — it composes the tools above on its own. For example:

• "Which requests failed in the last 10 minutes? Group them by host and explain one representative failure per group."
• "Why is the login endpoint on api.example.com slow? Break the latency into DNS, connect, TLS, and time to first byte."
• "Check the capture for passwords or tokens sent in cleartext."
• "Mock the /v2/feed response with this JSON — create the rule and enable it for me."

• The service is off by default and listens only after you enable it.
• Every /mcp* route requires a valid Bearer token.
• It is intended for the same Wi-Fi LAN or USB link, with no public-internet mapping.
• A client holding the token is inside the trusted boundary and can read complete capture details and call exposed import tools.
• If the token may have leaked, revoke it immediately to invalidate it and stop the service, then reset it.