MCP filter issue

[letallan]

There is a problem in TCP Viewer that when the agent selects filters, these filters are not visible in the user interface. And then it seems, when you enter the program, that it has stopped working at all, because the filters that the agent has set are not visible.

[NghiaTranUIT]

@letallan can you share with me your chat log? From what I see, TCP Viewer MCP doesn't offer any Filter Action to create or apply the filter.

The only action is query_packets -> MCP-only search, no UI state change.

If you can share a screenshot or a chat history, I can reproduce the bug

[letallan]

• Убираю установленный мной BPF-фильтр и оставляю TCP Viewer в режиме захвата всего трафика на en0. Пакеты очищать не буду.

• Called tcpviewer.get_capture_overview({})
└ {"active_interface_id": "utun4", "can_pause": true, "can_resume": false, "can_start": false, "can_stop": true,
"capture_filter": "host 1.1.1.1 and port 443", "capture_phase": "running", "decode_issue_count": 0,
"dropped_packet_count": "0", "packet_count": 18, "selected_interface_id": "en0", "source": "live", "status":
"Capture running on en0.", "truncated_packet_count": 0}

• Called tcpviewer.stop_capture({})
└ {"action": "stop_capture", "completed": true}

• Called tcpviewer.start_capture({"interface_id":"en0"})
└ {"action": "start_capture", "completed": true}

• Called tcpviewer.get_capture_overview({})
└ {"active_interface_id": "utun4", "can_pause": true, "can_resume": false, "can_start": false, "can_stop": true,
"capture_filter": "host 1.1.1.1 and port 443", "capture_phase": "running", "decode_issue_count": 0,
"dropped_packet_count": "0", "packet_count": 0, "selected_interface_id": "en0", "source": "live", "status": "Capture
running on en0.", "truncated_packet_count": 0}

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• Фильтр сохранился при запуске без параметра — TCP Viewer повторно использовал предыдущее значение. Сбрасываю его явно
пустой строкой и перепроверяю состояние.

• Called tcpviewer.stop_capture({})
└ {"action": "stop_capture", "completed": true}

• Called tcpviewer.start_capture({"interface_id":"en0","capture_filter":""})
└ {"action": "start_capture", "completed": true}

• Called tcpviewer.get_capture_overview({})
└ {"active_interface_id": "utun4", "can_pause": true, "can_resume": false, "can_start": false, "can_stop": true,
"capture_filter": "", "capture_phase": "running", "decode_issue_count": 0, "dropped_packet_count": "0",
"packet_count": 0, "selected_interface_id": "en0", "source": "live", "status": "Capture running on en0.",
"truncated_packet_count": 0}

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• Все BPF-фильтры отключены. TCP Viewer сейчас:

• захватывает весь трафик;
• интерфейс: en0;
• фильтр: пустой;
• состояние: захват запущен;
• пакеты не очищались.

[letallan]

Oh, I think I got it, Codex turned on some BPF filter. I thought this was functionality of the MCP, but it turns out the Codex itself supplemented the functionality :)

[NghiaTranUIT]

ok, I see. I will update the MCP, so agents will use the Query Action instead of the BPF filters (advanced settings)

[NghiaTranUIT]

Fixed it 👍