refactor: consolidate protocol analysis and add tool profiles

Author: bx33661

.github/copilot-instructions.md

@@ -1,6 +1,6 @@
 # GitHub Copilot Repository Instructions
 
-For packet capture, protocol analysis, network forensics, incident response, and troubleshooting tasks, prefer the project skill in `.github/skills/wireshark-traffic-analysis/`.
+For packet capture, protocol analysis, network security monitoring, incident response, and troubleshooting tasks, prefer the project skill in `.github/skills/wireshark-traffic-analysis/`.
 
 Use the skill to:
 

.github/prompts/wireshark-traffic-analysis.prompt.md

@@ -3,7 +3,7 @@ Use the `wireshark-traffic-analysis` project skill in this repository to investi
 Inputs:
 
 - Capture path: `${input:capture_path:Path to the pcap or pcapng file}`
-- Goal: `${input:goal:triage | security | incident-response | troubleshoot | ctf}`
+- Goal: `${input:goal:triage | security | incident-response | troubleshoot}`
 - Optional scope: `${input:scope:Suspicious host, protocol, time window, domain, stream, or symptom}`
 
 Requirements:

.gitignore

@@ -20,6 +20,7 @@ htmlcov/
 # Runtime caches
 .mcpregistry_*
 .claude/worktrees/
+.codex_resume_work/
 
 # OS metadata
 .DS_Store

CLAUDE.md

@@ -7,6 +7,5 @@ Use it for:
 - `pcap` and `pcapng` analysis
 - security hunting and incident response
 - network troubleshooting
-- CTF and forensics-style packet work
 
 Prefer the skill playbooks, evidence rubric, and report template over ad hoc analysis.

README.md

@@ -70,41 +70,57 @@ Point your AI client at a `.pcap` file and try:
 
 ```
 Analyze capture.pcap using the Wireshark MCP tools.
-Start with wireshark_open_file, then run wireshark_security_audit.
+Start with wireshark_open_file, then run wireshark_quick_analysis.
 Write findings to report.md.
 ```
 
 ---
 
 ## Tools
 
-80+ tools, each backed by real `tshark` output — organized into categories:
+51 tools, each backed by real `tshark` output — organized into categories:
 
 | Category | Highlights | Count |
 |----------|-----------|:-----:|
-| **Entry & Workflow** | `wireshark_open_file`, `wireshark_quick_analysis`, `wireshark_security_audit` | 3 |
-| **Packet Analysis** | Packet list, details, bytes, context, stream follow, search | 8 |
-| **Data Extraction** | HTTP requests, DNS queries, TLS handshakes, credentials, fields | 11 |
-| **Statistics** | Protocol hierarchy, endpoints, conversations, I/O graph, HTTP/SMB/RTP stats, plots | 13 |
-| **Security & Threat** | Credential scan, port scan, DNS tunnel, DoS, beaconing, exfiltration | 12 |
-| **Protocol Deep-Dive** | TCP health, QUIC, WebSocket, gRPC, MQTT, TLS/WPA decrypt, fingerprints | 11 |
-| **ICS / IoT / Wireless** | Modbus, S7comm, DNP3, CoAP, Zigbee, BLE, Wi-Fi, WireGuard | 8 |
-| **Forensics & Decode** | File carving, evidence chain, YARA scan, payload decode, GeoIP | 8 |
-| **File Ops, Capture & Suite** | Live capture, merge, filter-save, editcap trim/split/dedup, text2pcap | 11 |
+| **Entry & Workflow** | `wireshark_open_file`, `wireshark_quick_analysis` | 2 |
+| **Packet Analysis** | Packet list, details, bytes, context, stream follow, search, file info | 8 |
+| **Data Extraction** | HTTP requests, DNS queries, arbitrary fields, object export | 4 |
+| **Statistics** | Protocol hierarchy, endpoints, conversations, I/O graph, expert info, service response time, flow graph | 7 |
+| **Security & Anomaly** | Credential scan, port scan, DNS tunnel, DoS, beaconing, exfiltration, protocol anomalies, YARA | 8 |
+| **Protocol Analysis** | `wireshark_analyze_protocol` (20 protocols), TCP health, ARP spoofing | 3 |
+| **Decrypt & Dissection** | TLS/WPA decrypt, decryption check, decode-as, protocol preferences | 5 |
+| **Forensics & Enrichment** | TLS fingerprints, file signature scan, GeoIP | 3 |
+| **File Ops, Capture & Suite** | Live capture, interfaces, merge, filter-save, editcap trim/split/dedup/time-shift, frame extract, text2pcap, capabilities | 11 |
+
+One tool covers 20 protocols rather than 20 tools covering one each: `wireshark_analyze_protocol` takes a `protocol` argument (`tls_handshakes`, `mqtt`, `modbus`, `s7comm`, `zigbee`, `wifi`, `rtp`, `kerberos`, …) and applies the right fields and display filter for it. The field names are the point — `s7comm.param.item.dbnum` is not something a caller should have to guess, and a wrong guess returns an empty result that reads like a clean capture.
 
 The server starts with only `tshark` required. Optional tools (`capinfos`, `mergecap`, `editcap`, `dumpcap`, `text2pcap`) are auto-detected and enable extra features when present.
 
 ### Context cost
 
-The tool list travels in the prompt prefix of every request your client sends, so its size is a fixed per-request cost. The advertised surface is ~27 KB (~6.9k tokens) of schema plus ~5 KB of annotations, and it is byte-identical across restarts so clients can cache the prefix rather than re-reading it each session.
+The tool list travels in the prompt prefix of every request your client sends, so its size is a fixed per-request cost. The default surface is ~21 KB — about 9 KB of parameter schema, 5 KB of descriptions, and 3 KB of read/write annotations — and it is byte-identical across restarts so clients can cache the prefix rather than re-reading it each session.
+
+If your client never captures live traffic or writes pcaps, `--profile` advertises less:
+
+| Profile | Tools | Payload | Drops |
+|---------|:-----:|:-------:|-------|
+| `full` (default) | 51 | ~21 KB | nothing |
+| `analysis` | 41 | ~17 KB | live capture, interface listing, all file-writing tools |
+| `core` | 33 | ~14 KB | the above, plus decryption, dissection overrides, and low-level views |
+
+```bash
+wireshark-mcp serve --profile core
+```
+
+Every profile still contains every tool the bundled prompts, resources, skill files, and protocol recommendations can point the model at, so reducing the surface never leaves it chasing a tool that is not there.
 
 Tool results are bounded too, since a result stays in the conversation for the rest of the session. Output over 8000 characters is truncated head-and-tail with a marker, and the tool's `offset` / `limit` / `display_filter` parameters are the way to page through the rest. Raise or lower the ceiling with:
 
 ```bash
 export WIRESHARK_MCP_MAX_RESULT_CHARS=16000
 ```
 
-Every tool also declares whether it reads or writes, so clients can auto-approve the 74 read-only analysis tools and still prompt for the 11 that create files (live capture, merge, filter-save, editcap, text2pcap, object export).
+Every tool also declares whether it reads or writes, so clients can auto-approve the 40 read-only analysis tools and still prompt for the 11 that create files (live capture, merge, filter-save, editcap, text2pcap, frame extract, object export).
 
 ---
 

README_zh.md

@@ -70,41 +70,57 @@ wireshark-mcp install   # 自动配置所有检测到的 MCP 客户端
 
 ```
 使用 Wireshark MCP 工具分析 capture.pcap。
-先用 wireshark_open_file 打开，然后运行 wireshark_security_audit。
+先用 wireshark_open_file 打开，然后运行 wireshark_quick_analysis。
 将发现写入 report.md。
 ```
 
 ---
 
 ## 工具
 
-80+ 工具，每个都由真实 `tshark` 输出支撑，按类别组织：
+51 个工具，每个都由真实 `tshark` 输出支撑，按类别组织：
 
 | 类别 | 亮点 | 数量 |
 |------|------|:----:|
-| **入口与工作流** | `wireshark_open_file`、`wireshark_quick_analysis`、`wireshark_security_audit` | 3 |
-| **数据包分析** | 数据包列表、详情、字节、上下文、流追踪、搜索 | 8 |
-| **数据提取** | HTTP 请求、DNS 查询、TLS 握手、凭据、字段提取 | 11 |
-| **统计** | 协议层次、端点、会话、I/O 图、HTTP/SMB/RTP 统计、绘图 | 13 |
-| **安全与威胁** | 凭据扫描、端口扫描、DNS 隧道、DoS、信标、外泄 | 12 |
-| **协议深入** | TCP 健康、QUIC、WebSocket、gRPC、MQTT、TLS/WPA 解密、指纹 | 11 |
-| **工控/物联网/无线** | Modbus、S7comm、DNP3、CoAP、Zigbee、BLE、Wi-Fi、WireGuard | 8 |
-| **取证与解码** | 文件雕刻、证据链、YARA 扫描、载荷解码、GeoIP | 8 |
-| **文件操作、抓包与套件** | 实时抓包、合并、过滤保存、editcap 裁剪/分割/去重、text2pcap | 11 |
+| **入口与工作流** | `wireshark_open_file`、`wireshark_quick_analysis` | 2 |
+| **数据包分析** | 数据包列表、详情、字节、上下文、流追踪、搜索、文件信息 | 8 |
+| **数据提取** | HTTP 请求、DNS 查询、任意字段提取、对象导出 | 4 |
+| **统计** | 协议层次、端点、会话、I/O 图、专家信息、服务响应时间、流图 | 7 |
+| **安全与异常** | 凭据扫描、端口扫描、DNS 隧道、DoS、信标、外泄、协议异常、YARA | 8 |
+| **协议分析** | `wireshark_analyze_protocol`（20 种协议）、TCP 健康、ARP 欺骗 | 3 |
+| **解密与解析** | TLS/WPA 解密、解密校验、decode-as、协议偏好设置 | 5 |
+| **取证与富化** | TLS 指纹、文件特征扫描、GeoIP | 3 |
+| **文件操作、抓包与套件** | 实时抓包、接口列表、合并、过滤保存、editcap 裁剪/分割/去重/时移、帧提取、text2pcap、能力查询 | 11 |
+
+20 种协议由一个工具覆盖，而不是 20 个工具各覆盖一种：`wireshark_analyze_protocol` 接受 `protocol` 参数（`tls_handshakes`、`mqtt`、`modbus`、`s7comm`、`zigbee`、`wifi`、`rtp`、`kerberos` 等），并为其套用正确的字段与显示过滤器。字段名正是关键——`s7comm.param.item.dbnum` 不该由调用方去猜，而猜错时返回的空结果看起来和"干净的流量"没有区别。
 
 服务器仅需 `tshark` 即可启动。可选工具（`capinfos`、`mergecap`、`editcap`、`dumpcap`、`text2pcap`）自动检测，存在时启用额外功能。
 
 ### 上下文开销
 
-工具列表会随客户端的每一次请求进入 prompt 前缀，因此它的体积是每请求的固定成本。当前对外暴露的表面约为 27 KB（约 6.9k tokens）的 schema，加上约 5 KB 的 annotations；并且它在重启之间逐字节一致，客户端可以缓存该前缀，而不必每个会话重新读取。
+工具列表会随客户端的每一次请求进入 prompt 前缀，因此它的体积是每请求的固定成本。默认表面约为 21 KB——其中参数 schema 约 9 KB、描述约 5 KB、读写 annotations 约 3 KB；并且它在重启之间逐字节一致，客户端可以缓存该前缀，而不必每个会话重新读取。
+
+如果你的客户端从不实时抓包、也不写入 pcap，可以用 `--profile` 暴露更小的表面：
+
+| Profile | 工具数 | 载荷 | 移除的内容 |
+|---------|:-----:|:----:|-----------|
+| `full`（默认） | 51 | ~21 KB | 无 |
+| `analysis` | 41 | ~17 KB | 实时抓包、接口列表、以及全部写文件的工具 |
+| `core` | 33 | ~14 KB | 以上全部，再加解密、解析覆写与底层视图 |
+
+```bash
+wireshark-mcp serve --profile core
+```
+
+每个 profile 都仍然包含内置 prompts、resources、skill 文档以及协议推荐可能指向的全部工具，因此缩小表面不会让模型去调用一个并不存在的工具。
 
 工具结果同样有上限，因为一条结果会在会话余下的全部轮次里一直留在上下文中。超过 8000 字符的输出会保留首尾并标注截断位置，其余部分请用工具自带的 `offset` / `limit` / `display_filter` 参数翻页。调整上限：
 
 ```bash
 export WIRESHARK_MCP_MAX_RESULT_CHARS=16000
 ```
 
-每个工具都声明了自己是只读还是写入，因此客户端可以自动放行 74 个只读分析工具，同时仍然对会创建文件的 11 个工具（实时抓包、合并、过滤保存、editcap、text2pcap、对象导出）进行确认。
+每个工具都声明了自己是只读还是写入，因此客户端可以自动放行 40 个只读分析工具，同时仍然对会创建文件的 11 个工具（实时抓包、合并、过滤保存、editcap、text2pcap、帧提取、对象导出）进行确认。
 
 ---
 

skills/wireshark-traffic-analysis/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "wireshark-traffic-analysis"
-description: "Use when analyzing packet captures or live network traffic with Wireshark MCP; choose the right workflow for triage, security hunting, incident response, troubleshooting, or CTF work, then produce evidence-backed findings with exact filters, streams, frames, and next steps."
+description: "Use when analyzing packet captures or live network traffic with Wireshark MCP; choose the right workflow for triage, security hunting, incident response, or troubleshooting, then produce evidence-backed findings with exact filters, streams, frames, and next steps."
 ---
 
 # Wireshark Traffic Analysis
@@ -13,13 +13,12 @@ Use this skill to turn raw packet captures into a disciplined investigation. The
 - live traffic review after capture
 - security triage, threat hunting, or incident response
 - network and protocol troubleshooting
-- CTF and forensics-style packet challenges
 - any task where packet evidence matters more than intuition
 
 ## Required inputs
 
 - capture path
-- primary goal: `triage`, `security`, `incident-response`, `troubleshoot`, or `ctf`
+- primary goal: `triage`, `security`, `incident-response`, or `troubleshoot`
 - any known scope: suspicious host, port, domain, time window, protocol, or symptom
 
 If the user does not name a goal, default to `triage`.
@@ -46,7 +45,6 @@ If the user does not name a goal, default to `triage`.
 - Prefer Wireshark MCP tools over freehand `tshark` syntax.
 - Never guess display filter syntax. Use `wireshark://reference/display-filters`.
 - Use `wireshark://reference/protocol-fields` when you need field names for extraction or filters.
-- Never decode payloads manually when `wireshark_decode_payload` can verify the result.
 - Treat `wireshark_stats_expert_info` as a lead generator, not a final verdict.
 - When a finding depends on context, follow the full stream before concluding.
 - For large captures, paginate instead of treating the first page as representative.
@@ -95,7 +93,6 @@ Use the matching playbook in [references/playbooks.md](references/playbooks.md):
 - `security`: suspicious traffic, exfiltration, credential exposure, malware behavior
 - `incident-response`: reconstruct the timeline, scope, and affected systems
 - `troubleshoot`: retransmissions, latency, resets, failed handshakes, unstable services
-- `ctf`: flags, hidden payloads, staged transfers, encoded streams
 
 ## Built-in prompts and references
 
@@ -105,7 +102,6 @@ If the user mainly needs a starting workflow rather than a full investigation, t
 - `security_audit`
 - `performance_analysis`
 - `incident_response`
-- `ctf_solve`
 
 Use `wireshark://guide/usage` when you need the repo's built-in MCP workflow reference.
 

skills/wireshark-traffic-analysis/references/evidence-rubric.md

@@ -131,7 +131,7 @@ Counterexamples:
 
 Good confirmation tools:
 
-- `wireshark_extract_tls_handshakes`
+- `wireshark_analyze_protocol(protocol="tls_handshakes")`
 - `wireshark_follow_stream`
 
 ### TCP health problems

skills/wireshark-traffic-analysis/references/playbooks.md

@@ -8,7 +8,6 @@ Use these mode-specific playbooks after the initial overview in `SKILL.md`.
 - [Security](#security)
 - [Incident Response](#incident-response)
 - [Troubleshoot](#troubleshoot)
-- [CTF](#ctf)
 
 ## Triage
 
@@ -21,7 +20,7 @@ Recommended flow:
 3. `wireshark_stats_protocol_hierarchy`
 4. `wireshark_stats_endpoints`
 5. `wireshark_stats_conversations`
-6. `wireshark_plot_traffic` or `wireshark_stats_io_graph` if timing matters
+6. `wireshark_stats_io_graph` if timing matters
 7. Follow the most relevant streams with `wireshark_follow_stream`
 
 Interpretation notes:
@@ -44,16 +43,17 @@ Goal: determine whether the capture shows suspicious behavior and explain why.
 Recommended flow:
 
 1. Start with the triage playbook.
-2. Run `wireshark_security_audit` for a broad first pass.
+2. Run `wireshark_quick_analysis` for a broad first pass.
 3. Verify specific signals with:
    - `wireshark_extract_credentials`
    - `wireshark_detect_port_scan`
    - `wireshark_detect_dns_tunnel`
-   - `wireshark_analyze_suspicious_traffic`
+   - `wireshark_detect_beaconing`
+   - `wireshark_detect_exfiltration`
 4. If HTTP, DNS, or TLS matter, extract evidence with:
    - `wireshark_extract_http_requests`
    - `wireshark_extract_dns_queries`
-   - `wireshark_extract_tls_handshakes`
+   - `wireshark_analyze_protocol(protocol="tls_handshakes")`
 5. Follow suspicious conversations with `wireshark_follow_stream`.
 6. Use `wireshark_get_packet_details` or `wireshark_get_packet_context` to anchor claims in exact frames.
 
@@ -78,7 +78,7 @@ Recommended flow:
 
 1. Start with the triage playbook.
 2. Use `wireshark_get_file_info` to understand duration and capture boundaries.
-3. Use `wireshark_list_ips`, `wireshark_stats_endpoints`, and `wireshark_stats_conversations` to map actors.
+3. Use `wireshark_stats_endpoints` and `wireshark_stats_conversations` to map actors.
 4. Use security-focused tools to identify IOCs and suspicious traffic.
 5. Follow the streams that matter most for:
    - initial contact
@@ -111,7 +111,7 @@ Recommended flow:
    - `wireshark_stats_protocol_hierarchy`
    - `wireshark_stats_endpoints`
    - `wireshark_stats_conversations`
-   - `wireshark_plot_traffic` or `wireshark_stats_io_graph`
+   - `wireshark_stats_io_graph`
 3. Use protocol health tools:
    - `wireshark_analyze_tcp_health`
    - `wireshark_stats_expert_info`
@@ -130,31 +130,3 @@ Deliver:
 - probable bottleneck or failure mode
 - exact evidence
 - what to test next outside the capture if needed
-
-## CTF
-
-Goal: recover the flag or hidden payload while documenting the extraction path.
-
-Recommended flow:
-
-1. Start with `wireshark_open_file` and `wireshark_quick_analysis`.
-2. Search for obvious markers:
-   - `wireshark_search_packets(..., "flag", scope="bytes")`
-   - `wireshark_search_packets(..., "CTF", scope="bytes")`
-   - `wireshark_search_packets(..., "password", scope="bytes")`
-3. Inspect DNS, HTTP, TLS, ICMP, SMTP, or unusual protocols for encoded payloads.
-4. Use `wireshark_follow_stream` on interesting streams.
-5. Use `wireshark_decode_payload` for Base64, hex, URL encoding, gzip, and similar content.
-6. If files were transferred, use `wireshark_export_objects`.
-
-Interpretation notes:
-
-- `wireshark_follow_stream` stream indexes are zero-based, mirroring Wireshark's stream selection behavior.
-- If the flag path is not obvious, pivot from endpoints to conversations to candidate streams instead of opening streams at random.
-
-Deliver:
-
-- flag or recovered artifact
-- extraction path
-- exact evidence chain
-- any decoding steps required

skills/wireshark-traffic-analysis/references/report-template.md

@@ -7,7 +7,7 @@ Adapt this template to the user's goal. Keep it short unless the user asks for d
 
 ## Scope
 - Capture: `<path>`
-- Goal: `<triage | security | incident-response | troubleshoot | ctf>`
+- Goal: `<triage | security | incident-response | troubleshoot>`
 - Assumptions: `<none>` or `<brief list>`
 
 ## Executive Summary