desvert

Containerized MCP server for parsing OT/ICS packet captures. Uses tshark to dissect Modbus/TCP and BACnet/IP traffic from saved PCAP files and returns structured JSON -- decoded transactions and a basic device inventory -- that an LLM can reason over directly. Designed for use with Claude Code. Runs with a read-only evidence mount