Does NetPeek MCP upload captures to a cloud service?
NetPeek does not upload them. The service listens locally and is reachable over the same Wi-Fi LAN or USB; review the privacy behavior of the AI client you choose to connect.
Manual
NetPeek MCP: Let Claude or Codex Analyze iPhone Captures
NetPeek MCP is off by default. After you enable it and provide a Bearer token, AI clients on the same Wi-Fi or USB can inspect captures. NetPeek does not upload captures—review the AI client’s privacy behavior.
Enable and connect
To let a desktop AI client help analyze captures on this phone, turn on NetPeek MCP. Find it under Settings → NetPeek MCP (off by default).
- Open Settings → NetPeek MCP.
- Enable the service and copy the access token.
- Enter the MCP URL and token in an AI client on the same Wi-Fi or USB.
Don’t share the token with untrusted people, and avoid leaving the service on untrusted networks. Turn it off or revoke the token when you’re done.
Claude Code / generic MCP client configuration
Copy the current MCP URL and token from NetPeek. The in-app one-tap install prompt already carries the current address, token, and capability metadata and is the least error-prone option. For manual setup, pick one:
Option 1: Claude Code CLI
claude mcp add --transport http netpeek http://<PHONE_IP>:<PORT>/mcp \
--header "Authorization: Bearer <PASTE_TOKEN_FROM_NETPEEK>"Option 2: generic JSON config (Claude Desktop, Codex, Cursor, …)
Merge mcpServers.netpeek into the client configuration without replacing existing servers:
{
"mcpServers": {
"netpeek": {
"type": "http",
"url": "http://<PHONE_IP>:<PORT>/mcp",
"headers": {
"Authorization": "Bearer <PASTE_TOKEN_FROM_NETPEEK>"
}
}
}
}curl connectivity and authentication check
curl -H 'Authorization: Bearer <PASTE_TOKEN_FROM_NETPEEK>' http://<PHONE_IP>:<PORT>/mcp/healthAfter the health check succeeds, reload the MCP client and explicitly refresh tools/list, resources/list, and prompts/list.
The 15 capture tools available to AI clients
Once connected, an AI client can call the tools below. Compact listings are redacted by default; full details, raw bodies, and configuration import all sit behind Bearer authentication.
| Tool | What it does |
|---|---|
| list_requests | Paginated recent captures (compact, redacted) |
| search_requests | Search by host, URL keyword, or status code |
| get_request | Full detail for one request: URL, headers, body digest or raw |
| get_body | Byte-exact, pageable request/response body reads |
| get_stats | Capture totals, host distribution, status-code stats |
| list_runs | List capture runs |
| get_run | Summary of one capture run |
| list_favorites | List favorited requests |
| decode_jwt | Decode JWTs found in traffic |
| explain_tls | Explain TLS handshake, version, and certificate details |
| analyze_timing | Timing waterfall: DNS / connect / TLS / TTFB / download |
| audit_security | Scan for PII, credentials, tokens in URLs, weak TLS, unexpected third-party hosts |
| diff_runs | Diff two runs: endpoint, status, and timing drift |
| infer_api_schema | Infer an OpenAPI-like schema for a host from captures |
| import_rewrite_bundle | Validate and import rewrite rules, scripts, replays, constants |
Built-in analysis prompts (ready-made debugging playbooks)
NetPeek MCP also ships a catalog of analysis playbooks that clients supporting prompts/list can pick directly:
traffic_triage— First-pass triage: top hosts, errors, slow endpoints, anomaliesdebug_api_failure— Locate a failing API by status/host/keyword and evidence its root causeprivacy_audit— Find PII, credential leaks, weak TLS, unexpected third partieswhy_slow— Explain a slow request with the timing waterfallfind_cleartext— Find cleartext traffic and certificate anomaliesdiff_captures— Compare two capture runs and summarize driftreverse_api— Draft an API schema for a target hostexplain_app_behavior— Explain the captured app's overall network behaviorinstall_rewrite_bundle— Translate debugging intent into one validated rule import
What does it look like in practice?
Once connected, just ask your AI assistant in plain language — it composes the tools above on its own. For example:
- "Which requests failed in the last 10 minutes? Group them by host and explain one representative failure per group."
- "Why is the login endpoint on api.example.com slow? Break the latency into DNS, connect, TLS, and time to first byte."
- "Check the capture for passwords or tokens sent in cleartext."
- "Mock the /v2/feed response with this JSON — create the rule and enable it for me."
Security model
- The service is off by default and listens only after you enable it.
- Every /mcp* route requires a valid Bearer token.
- It is intended for the same Wi-Fi LAN or USB link, with no public-internet mapping.
- A client holding the token is inside the trusted boundary and can read complete capture details and call exposed import tools.
- If the token may have leaked, revoke it immediately to invalidate it and stop the service, then reset it.
FAQ
Is authentication required?
Yes. Every /mcp route requires a valid Authorization: Bearer <token> header; missing or invalid credentials are rejected.
What should I do if the token leaks?
Tap Revoke Token in NetPeek to invalidate it immediately and stop the service, then use Reset Token to issue a fresh credential.