Analysing SIP captures with your AI assistant
Short version: hiccup is an MCP server, so the assistant you already work in — Claude Code, Claude Desktop, Cursor — can read your captures directly. The division of labour is the whole point: your assistant brings the reasoning, hiccup brings evidence it cannot hallucinate — the parsed messages, the deterministic findings, and advice whose RFC citations were verified by a human, not generated. Setup is two steps and documented here; this page is about how to actually work with it once it is connected.
Why bolt an AI onto a deterministic analyser at all
hiccup's analysis is deliberately not AI: the same pcap always produces the same findings, the correlation confidence is a number you can argue with, and every citation in an advice card points at a real section of a real document. That is what makes a verdict trustworthy at 3am. But a language model is genuinely good at the parts around the verdict: connecting a finding to the change your team shipped yesterday, walking a junior engineer through why an ACK that never lands drops the call at exactly 32 seconds, or drafting the ticket to the carrier with the right evidence attached. Over MCP those two halves meet without contaminating each other — the model reasons, but every protocol fact it uses came out of a tool call it cannot fake.
The shape of a good session
Assistants use hiccup well when they orient first, then narrow. The pattern that works, and that you can prompt for explicitly:
| Step | Tool(s) the assistant should reach for | What comes back |
|---|---|---|
| 1. Orient | list_captures | Every capture in the account with message counts and finding severities — and the capture_id every other tool needs. |
| 2. Triage | list_findings | Every finding, worst first, each naming the messages that prove it. Nothing is truncated. |
| 3. Explain | get_advice | hiccup's articulation of the fault: what is wrong, why it matters, the mechanism, vendor-specific fixes — and the only citations worth repeating. |
| 4. Verify | get_call, get_message, search_messages | The call's leg structure and ingress/egress diff, and the raw messages themselves (credentials already redacted). |
| 5. Fix | generate_hmr_rule → simulate_hmr | A drafted header-manipulation rule, then that rule executed against the real failing message with a before/after of every touched header. |
Step 5 deserves emphasis, because it is the one most people do not expect to work: the assistant can draft an HMR rule and then prove or disprove it against the actual INVITE from your capture before you ever see it. Ask for exactly that — "verify it against the real message before showing me" — and a wrong draft gets caught by the simulator instead of by your SBC.
Prompts that get good answers
- "Using hiccup, list my captures, pick the one from this morning, and walk me through the worst finding — quote the message ids as evidence."
- "Why does this call answer and then drop? Follow the ACK. Show me the exact messages that prove your answer."
- "Compare the ingress and egress INVITE on call c1 — what did the SBC change, and which change would break the far end?"
- "Draft an Oracle Acme rule that fixes the leaked private address, simulate it against the real 200 OK, and show the before/after."
- "Summarise this capture for a carrier ticket: symptom, evidence with message ids, and what we need them to check."
The common thread: ask for message ids and before/afters, not
just conclusions. The tools return them, and an answer that cites s7
and s9 is one you can check in the workbench in
ten seconds.
Where the boundary sits
Two rules keep the output honest. First, everything over MCP is read-only — an assistant can never upload, alter or delete a capture, so the worst a confused prompt can do is read the wrong thing. Second, protocol citations belong to hiccup, not the model: the advice cards carry hand-verified references, and a well-behaved assistant repeats those rather than recalling section numbers from training data. If an answer cites an RFC section that no tool result contained, treat it exactly as you would a colleague quoting a spec from memory — check it. The same discipline hiccup's deterministic analysis applies to itself is the standard to hold the assistant to.
Practicalities
- Tokens are created on Settings, shown once, revocable instantly, and scoped to your account — the assistant sees exactly the captures you see, on the Pro and Team plans.
- Phone numbers and credentials follow the same redaction rules as the workbench. What the model reads is what you would read.
- 120 tool calls per minute per token — no interactive session comes near it; a runaway agent loop hits the wall instead of your disk.
- The full client configuration for Claude Code, Claude Desktop and Cursor is on the MCP setup page.