🌐 netvibe

Zero-Driver Process Network Sniffer, Shaper & AI Client Synthesizer MCP

_{No Wireshark. No Fiddler. Just Vibe.}

🇺🇸 English · 🇰🇷 한국어 · 🇨🇳 简体中文 · 🇯🇵 日本語 · 🇪🇸 Español
🇫🇷 Français · 🇷🇺 Русский · 🇧🇷 Português · 🇸🇦 العربية · 🇮🇳 हिन्दी

---

📌 1. What is netvibe?

netvibe is a standalone, high-performance network reverse-engineering and traffic shaping Model Context Protocol (MCP) server built in pure Rust. It allows AI coding agents (Claude Code, Cursor, Windsurf, Antigravity) to inspect, capture, shape, and clone application network traffic without ever installing Npcap or launching Wireshark.

⚡ Key Capabilities

1. Zero-Driver, Zero-Noise WFP Engine:
   • Operates entirely in user mode via Windows Filtering Platform (fwpmu.dll, fwpuclnt.dll) with FWPM_SESSION_FLAG_DYNAMIC.
   • Isolates a specific Process ID (PID) or .exe at the kernel/socket layer, filtering out 99.9% of system background noise (Windows Update, Chrome tabs, telemetry).
   • If netvibe terminates or crashes, the Windows kernel automatically cleans up all filters with zero residual state.
2. L7 Stream Reassembly & Token Compressor:
   • Reassembles raw TCP packets into complete HTTP/1.1, HTTP/2, WebSocket, Server-Sent Events (SSE), and gRPC / Protocol Buffers streams.
   • Heuristically decodes schema-less Protocol Buffers wire formats, 5-byte gRPC framing, and canonical status codes without requiring .proto files.
   • Automatically masks authorization headers, passwords, and secrets.
   • Converts megabytes of raw PCAP data into compact, normalized JSON schemas (<1,500 tokens), preventing LLM context window overflows.
3. Multi-Language Client Synthesizer:
   • Synthesizes clean, production-ready API client SDKs in Python (httpx), TypeScript (fetch), or Go (net/http) with one prompt.
4. Dual MCP Transports (stdio & SSE):
   • Supports both standard I/O (stdio) and HTTP Server-Sent Events (SSE, MCP 2024-11-05 specification) with zero external web framework dependencies.
5. NetLimiter Mode (Traffic Shaping & Chaos):
   • Sets per-process bandwidth throttling (KB/s), artificial latency injection (+ms), and probabilistic packet loss to test how AI-generated clients handle network resilience.
6. simplewall Mode (Process Firewall):
   • Instantly blocks or permits all inbound/outbound traffic for a PID or specific destination domains.
7. Instant In-Memory Mock Server:
   • Spins up a local HTTP/1.1 server mirroring the recorded endpoints and payloads for offline testing.

---

🏛️ 2. System Architecture

flowchart TB
    subgraph ClientLayer["AI Coding Agents & Interfaces"]
        LLM["AI Agent (Claude / Cursor / Antigravity)"]
        CLI["netvibe CLI (Terminal)"]
    end

    subgraph NetvibeCore["netvibe.exe Core"]
        MCPServer["MCP JSON-RPC 2.0 Engine<br/>(stdio & SSE Transports)"]
        ProcMgr["Process & Socket Monitor<br/>(IP Helper GetExtendedTcpTable)"]
        WFPEngine["WFP Dynamic Controller<br/>(FWPM_SESSION_FLAG_DYNAMIC)"]
        RingBuf["Bounded Ring Buffer<br/>(Strict <40MB Memory Cap)"]
        Dissector["L7 Stream Dissector<br/>(HTTP/1.1, HTTP/2, WS, SSE, gRPC)"]
        Compressor["Token Schema Compressor<br/>(95% Context Compression)"]
        Synthesizer["Multi-Language SDK Synthesizer<br/>(Python / TypeScript / Go)"]
        Shaper["Traffic Shaper & Chaos<br/>(NetLimiter Throttling & Delay)"]
        Firewall["Process Firewall<br/>(simplewall Block / Allow)"]
        Mock["In-Memory Mock Replay Server"]
    end

    subgraph WindowsOS["Windows Subsystem"]
        Kernel["Windows Kernel / BFE"]
        TargetApp["Target Process (e.g. Launcher.exe PID: 4820)"]
    end

    LLM <-->|stdio & SSE JSON-RPC| MCPServer
    CLI <--> MCPServer
    MCPServer --> ProcMgr
    MCPServer --> WFPEngine
    MCPServer --> Shaper
    MCPServer --> Firewall
    MCPServer --> Synthesizer
    MCPServer --> Mock

    ProcMgr <--> TargetApp
    WFPEngine <--> Kernel
    RingBuf --> Dissector
    Dissector --> Compressor
    Compressor --> Synthesizer

---

🛠️ 3. MCP Tool Catalog (10 Tools)

Tool Name	Description
netvibe_list_processes	Lists active processes with their PID, name, path, and open socket count
netvibe_get_process_connections	Queries real-time TCP connections and UDP listeners for a specific PID
netvibe_start_capture	Starts zero-driver WFP capture for target PID (ignores all system noise)
netvibe_stop_capture	Stops active capture session and summarizes metrics
netvibe_get_session_summary	Returns token-optimized schema summary of observed API endpoints
netvibe_dissect_flow	Dissects granular L7 request/response headers and JSON payloads
netvibe_generate_client	Synthesizes working client code in Python (httpx), TypeScript, or Go
netvibe_set_traffic_shaping	NetLimiter mode: rate limits bandwidth (KB/s), injects latency (+ms)
netvibe_set_firewall_rule	simplewall mode: blocks or permits network traffic for a PID
netvibe_start_mock_server	Starts an instant local mock server serving recorded responses

---

🚀 4. Quick Start

1. Add to Claude Desktop or Antigravity MCP Config

Add netvibe to your claude_desktop_config.json:

{
  "mcpServers": {
    "netvibe": {
      "command": "C:\\github_nvcxzgo\\netvibe\\target\\release\\netvibe.exe",
      "args": ["mcp"]
    },
    "netvibe-sse": {
      "url": "http://127.0.0.1:8080/sse"
    }
  }
}

2. Standalone CLI Usage

# 1. View WFP engine status
netvibe status

# 2. List all processes with open network sockets
netvibe list

# 3. Filter processes by name
netvibe list --filter chrome

# 4. Run MCP server over Server-Sent Events (SSE) transport
netvibe mcp --transport sse --host 127.0.0.1 --port 8080

# 5. Apply NetLimiter latency delay (+250ms) to PID 7620
netvibe shape --pid 7620 --latency-ms 250 --throttle-kbps 500

# 6. Block all network traffic for PID 7620 (simplewall mode)
netvibe block --pid 7620 --all

---

🔒 5. Security & Invariants

1. Kernel Resource Zero-Leak Invariant:
   • netvibe sessions use FWPM_SESSION_FLAG_DYNAMIC. If netvibe crashes or terminates unexpectedly, the Windows kernel automatically cleans up all injected filters.
2. Secret & PII Sanitization:
   • Sensitive headers (Authorization, Cookie) and JSON keys (password, token, secret) are masked automatically before reaching AI agent contexts.
3. Bounded Memory Constraints:
   • Circular ring buffers enforce strict memory caps (<40MB) under heavy network packet throughput.

---

🪞 6. Multi-Platform Mirrors / 다중 플랫폼 미러

Platform	Repository URL	Status
GitHub (Primary)	github.com/kLauncher1/netvibe
GitLab	gitlab.com/klg6av9z1/netvibe
Hugging Face	huggingface.co/klhf93xq1/netvibe

---

📜 7. License

Copyright (c) 2026 nvcxzgo. All Rights Reserved.

This software is Proprietary & Confidential (Source-Available for inspection and personal evaluation only).
Unauthorized copying, reproduction, modification, distribution, sublicensing, or commercial deployment of this software or any portion thereof is strictly prohibited. See LICENSE for the full agreement terms.