Skip to content
SPECIFICTION
Get listed

PcapAI

pcapai.com

From $9.50/mo Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit pcapai.com
Spec score 8.4 #6 of 32 in Network Packet Analyzer Software

What it is

PcapAI analyzes PCAP and PCAPNG network captures and creates security reports. Its machine-learning models evaluate packet context and relate findings to MITRE ATT&CK techniques. Reports are downloadable PDFs with risk scores, packet evidence, findings, and remediation steps. The service detects plaintext credentials, NTLM hashes, Kerberos tickets, and session tokens, then masks discovered credentials in reports. It also surfaces retransmissions, per-flow latency, TCP Zero Window events, and ARP conflicts. The homepage offers free uploads without an account; compressed archives are not accepted, and file-size limits vary by plan. Options include web, API, Windows, macOS, Linux, and self-hosted use. An open-source MCP Server supports local analysis with AI assistants such as Claude Desktop; the maker says packet data stays on the device. The Advanced plan includes API access, and the maker describes sending findings to Splunk, Elastic SIEM, or Microsoft Sentinel. Pricing includes a $9.00 USD one-time Single Report, monthly and annual plans, and one-time packs.

Spec sheet

What it does
PcapAI is a web platform that automatically analyzes PCAP and PCAPNG captures with AI and deep packet inspection.Read 14 Oct 2026 · pcapai.com
Product
PcapAI is a web-based platform that analyzes PCAP and PCAPNG network captures and produces security reports.Read 7 Oct 2026 · pcapai.com
Audience
The maker identifies SecOps and SOC analysts, DevOps and NetOps engineers, and security consultants and pentesters as its primary audiences.Read 7 Oct 2026 · pcapai.com
Integrations
The maker describes use with SIEM systems, CI/CD pipelines, ticketing workflows and custom backend scripts.Read 14 Oct 2026 · pcapai.com
Security
The maker says transfers use TLS 1.3, files are encrypted at rest during processing, and each analysis runs in an isolated container.Read 7 Oct 2026 · pcapai.com
Support
The FAQ says most standard captures process in under one to two minutes and high-volume files often complete in under five minutes on dedicated infrastructure.Read 7 Oct 2026 · pcapai.com
Analysis speed
The about page says a full report is typically produced in under two minutes.Read 14 Oct 2026 · pcapai.com
API authentication
API requests require a Bearer token and API access is restricted to Advanced subscribers.Read 14 Oct 2026 · pcapai.com
API modes
Uploads can specify security, troubleshooting, compliance, forensic or shadow-it analysis modes.Read 14 Oct 2026 · pcapai.com
Credential exposure
It searches captures for cleartext passwords, NTLM hashes, Kerberos tickets and session tokens, then masks discovered secrets in reports.Read 14 Oct 2026 · pcapai.com
Credential masking
Cleartext credentials and sensitive payloads are mathematically masked in generated reports rather than printed.Read 14 Oct 2026 · pcapai.com
Credentials
The product detects plaintext credentials, NTLM hashes, Kerberos tickets, and session tokens, and masks discovered credentials in reports.Read 7 Oct 2026 · pcapai.com
Developer documentation
Official developer documentation covers MCP setup, REST authentication, upload polling, report download and automation examples.Read 14 Oct 2026 · pcapai.com
File limits
PcapAI accepts PCAP and PCAPNG files; compressed archives are unsupported, and file-size limits depend on the plan.Read 7 Oct 2026 · pcapai.com
Free use
Users can upload a PCAP without an account and receive a free threat summary; the full forensic PDF costs $9.Read 14 Oct 2026 · pcapai.com
GitHub macOS limitation
The repository warns that its unsigned binary triggers macOS Gatekeeper and may require removing the quarantine attribute.Read 14 Oct 2026 · github.com
GitHub prerequisites
The repository lists Rust 1.75 or newer, an optional PcapAI API key and Claude Desktop or another MCP-compatible client as prerequisites.Read 14 Oct 2026 · github.com
GitHub protocol
The MCP server communicates using JSON-RPC 2.0 over standard input/output and uses reqwest with rustls plus Tokio.Read 14 Oct 2026 · github.com
GitHub repository status
The public pcap-ai/mcp-server repository shows one star, zero forks and five commits when crawled.Read 14 Oct 2026 · github.com
GitHub size error
The repository documents HTTP 413 errors when an uploaded capture exceeds the service limit.Read 14 Oct 2026 · github.com
GitHub workflow
The repository documents a flow that reads a local capture, uploads it to the REST API, polls completion and saves the generated PDF beside the capture.Read 14 Oct 2026 · github.com
Limit: capture scope
The homepage says Wi-Fi monitor-mode, USB and Bluetooth captures are unsupported, and compressed archives are not accepted.Read 14 Oct 2026 · pcapai.com
Limit: file size
The free analyzer accepts files up to 20 MB; Starter allows 25 MB and Pro or Advanced allow 50 MB.Read 14 Oct 2026 · pcapai.com
Limit: larger deployments
Custom file-size limits, higher volumes and on-premise deployment require contacting sales.Read 14 Oct 2026 · pcapai.com
Local analysis
The maker offers an open-source MCP Server for local PCAP analysis with AI assistants such as Claude Desktop; it says packet data stays on the device.Read 7 Oct 2026 · pcapai.com
MCP cloud dependency
Although the MCP binary runs locally, it uploads the capture to PcapAI over TLS for server-side analysis and therefore does not operate offline.Read 14 Oct 2026 · pcapai.com
MCP integration
The MCP server lets AI clients such as Claude Desktop invoke PCAP analysis and MITRE mapping from a local file path.Read 14 Oct 2026 · pcapai.com
MCP licence
The MCP server is released as open-source Rust software under the MIT licence.Read 14 Oct 2026 · pcapai.com
Performance
PcapAI reports retransmissions, per-flow latency, TCP Zero Window events, and ARP conflicts.Read 7 Oct 2026 · pcapai.com
Reports
Analyses produce PDF reports containing network statistics, threat findings and remediation guidance.Read 14 Oct 2026 · pcapai.com
REST API
The REST API exposes POST /api/v1/upload, GET /api/v1/check and GET /api/v1/download endpoints and returns PDF output.Read 14 Oct 2026 · pcapai.com
Retention discrepancy
The homepage and API documentation instead describe automatic deletion 24 hours after upload, creating a conflicting stated retention period.Read 14 Oct 2026 · pcapai.com
Retention limit
The FAQ says uploaded captures and reports are permanently deleted after 60 minutes.Read 14 Oct 2026 · pcapai.com
Security controls
The maker states that transfers use TLS 1.3, files are encrypted in Amazon S3 and analyses run in isolated containers.Read 14 Oct 2026 · pcapai.com
Supported files
Native .pcap and .pcapng files are accepted, while ZIP, RAR and other compressed archives are rejected.Read 14 Oct 2026 · pcapai.com
Threat analysis
Its machine-learning models analyze packet context and map findings to MITRE ATT&CK techniques.Read 7 Oct 2026 · pcapai.com
Threat detection
The service detects behaviors including ARP spoofing, DNS tunneling, C2 beaconing, scanning, Kerberoasting and DCSync, with 68 published ATT&CK techniques.Read 14 Oct 2026 · pcapai.com
Troubleshooting
It measures packet loss, round-trip time, TCP zero windows, MTU black holes, DNS failures and slow server responses to identify likely fault ownership.Read 14 Oct 2026 · pcapai.com

Plans and prices

Single Report $9, paid once one-time 25MB max file · 1 PCAP upload · 1 PDF report Read 14 Oct 2026 · pcapai.com
Starter $19 a month monthly 25MB max file · 5 reports/month Read 14 Oct 2026 · pcapai.com
Starter pack $35, paid once one-time 25MB max file · 5 uploads · 5 PDF reports · credits never expire Read 14 Oct 2026 · pcapai.com
Pro $49 a month monthly 50MB max file · 20 reports/month Read 14 Oct 2026 · pcapai.com
Standard pack $83, paid once one-time 25MB max file · 15 uploads · 15 PDF reports · credits never expire Read 14 Oct 2026 · pcapai.com
Advanced $99 a month monthly 50MB max file · 50 reports/month · API access Read 14 Oct 2026 · pcapai.com
Starter (yearly) $114 a year $114 /year · Just $9.50/mo, billed annually 25MB max size · 60 reports / year Read 7 Oct 2026 · pcapai.com
Starter yearly $114 a year yearly 25MB max file · 60 reports/year Read 14 Oct 2026 · pcapai.com
Pro pack $135, paid once one-time 25MB max file · 30 uploads · 30 PDF reports · credits never expire Read 14 Oct 2026 · pcapai.com
Pro (yearly) $294 a year $294 /year · Just $24.50/mo, billed annually 50MB max size · 240 reports / year Read 7 Oct 2026 · pcapai.com
Pro yearly $294 a year yearly 50MB max file · 240 reports/year Read 14 Oct 2026 · pcapai.com
Advanced (yearly) $594 a year $594 /year · Just $49.50/mo, billed annually 50MB max size · 600 reports / year · API access Read 7 Oct 2026 · pcapai.com

Every PcapAI plan and price →

Strong points and limits

Strong points

  • Maps packet findings to MITRE ATT&CK techniques
  • PDFs include packet evidence and remediation steps
  • Masks detected credentials in reports
  • Reports network performance and ARP events
  • Free uploads do not require an account

Limits

  • Compressed archives are unsupported
  • File-size limits depend on the plan
  • Live capture is not available

Who it suits

It suits SecOps and SOC analysts, DevOps and NetOps engineers, and security consultants or pentesters who need to inspect capture files. It also offers local analysis for users who want packet data to stay on their device.

Verdict

PcapAI combines security findings with packet-level evidence and troubleshooting details in downloadable reports. Check the plan’s file-size and report limits before choosing a paid option.

Where Specifiction places it

Alternatives to PcapAIAll alternatives →