NetPeek MCP: Let Claude or Codex Analyze iPhone Captures

NetPeek MCP is an off-by-default local service. After the user enables it, trusted Claude, Codex, and compatible AI clients on the same Wi-Fi or USB connection can use a Bearer token to inspect captures and, when requested, import rewrite rules, scripts, replays, and constants.

11MCP service

To let a desktop AI client help analyze captures on this phone, turn on NetPeek MCP. Find it under Settings → NetPeek MCP (off by default).

Enable the service and copy the access token.
On a computer on the same network (or over USB), enter the service address and token in your AI client.
Once connected, you can browse captures, inspect requests, and import rules when needed.

Don’t share the token with untrusted people, and avoid leaving the service on untrusted networks. Turn it off or revoke the token when you’re done.

Claude Code / generic MCP client configuration

Copy the current MCP URL and token from NetPeek. The in-app one-tap install prompt already carries the current address, token, and capability metadata and is the least error-prone option. For manual setup, pick one:

Option 1: Claude Code CLI

claude mcp add --transport http netpeek http://<PHONE_IP>:<PORT>/mcp \
  --header "Authorization: Bearer <PASTE_TOKEN_FROM_NETPEEK>"

Option 2: generic JSON config (Claude Desktop, Codex, Cursor, …)

Merge mcpServers.netpeek into the client configuration without replacing existing servers:

{
  "mcpServers": {
    "netpeek": {
      "type": "http",
      "url": "http://<PHONE_IP>:<PORT>/mcp",
      "headers": {
        "Authorization": "Bearer <PASTE_TOKEN_FROM_NETPEEK>"
      }
    }
  }
}

curl connectivity and authentication check

curl -H 'Authorization: Bearer <PASTE_TOKEN_FROM_NETPEEK>' http://<PHONE_IP>:<PORT>/mcp/health

After the health check succeeds, reload the MCP client and explicitly refresh tools/list, resources/list, and prompts/list.

The 15 capture tools available to AI clients

Once connected, an AI client can call the tools below. Compact listings are redacted by default; full details, raw bodies, and configuration import all sit behind Bearer authentication.

Tool	What it does
`list_requests`	Paginated recent captures (compact, redacted)
`search_requests`	Search by host, URL keyword, or status code
`get_request`	Full detail for one request: URL, headers, body digest or raw
`get_body`	Byte-exact, pageable request/response body reads
`get_stats`	Capture totals, host distribution, status-code stats
`list_runs`	List capture runs
`get_run`	Summary of one capture run
`list_favorites`	List favorited requests
`decode_jwt`	Decode JWTs found in traffic
`explain_tls`	Explain TLS handshake, version, and certificate details
`analyze_timing`	Timing waterfall: DNS / connect / TLS / TTFB / download
`audit_security`	Scan for PII, credentials, tokens in URLs, weak TLS, unexpected third-party hosts
`diff_runs`	Diff two runs: endpoint, status, and timing drift
`infer_api_schema`	Infer an OpenAPI-like schema for a host from captures
`import_rewrite_bundle`	Validate and import rewrite rules, scripts, replays, constants

Built-in analysis prompts (ready-made debugging playbooks)

NetPeek MCP also ships a catalog of analysis playbooks that clients supporting prompts/list can pick directly:

traffic_triage — First-pass triage: top hosts, errors, slow endpoints, anomalies
debug_api_failure — Locate a failing API by status/host/keyword and evidence its root cause
privacy_audit — Find PII, credential leaks, weak TLS, unexpected third parties
why_slow — Explain a slow request with the timing waterfall
find_cleartext — Find cleartext traffic and certificate anomalies
diff_captures — Compare two capture runs and summarize drift
reverse_api — Draft an API schema for a target host
explain_app_behavior — Explain the captured app's overall network behavior
install_rewrite_bundle — Translate debugging intent into one validated rule import

What does it look like in practice?

Once connected, just ask your AI assistant in plain language — it composes the tools above on its own. For example:

"Which requests failed in the last 10 minutes? Group them by host and explain one representative failure per group."
"Why is the login endpoint on api.example.com slow? Break the latency into DNS, connect, TLS, and time to first byte."
"Check the capture for passwords or tokens sent in cleartext."
"Mock the /v2/feed response with this JSON — create the rule and enable it for me."

Security model

The service is off by default and listens only after you enable it.
Every /mcp* route requires a valid Bearer token.
It is intended for the same Wi-Fi LAN or USB link, with no public-internet mapping.
A client holding the token is inside the trusted boundary and can read complete capture details and call exposed import tools.
If the token may have leaked, revoke it immediately to invalidate it and stop the service, then reset it.

FAQ

Does NetPeek MCP upload captures to a cloud service?

NetPeek does not upload them. The service listens locally and is reachable over the same Wi-Fi LAN or USB; review the privacy behavior of the AI client you choose to connect.

Is authentication required?

Yes. Every /mcp route requires a valid Authorization: Bearer <token> header; missing or invalid credentials are rejected.

What should I do if the token leaks?

Tap Revoke Token in NetPeek to invalidate it immediately and stop the service, then use Reset Token to issue a fresh credential.