Netmon

Name: Netmon
Author: com.netmon

MCP serverMCP

Query devices, alerts, syslog, Suricata IDS, NetFlow and captures on your Netmon appliance.

Until 2026-09-26 this record combined several servers published from one repository. The others now have records of their own: Netmon (demo). Checks from before that date include them.

by com.netmonrepository ↗homepage ↗v0.1.9

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"netmon","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability53/53 checks ok

Tools observed via MCP handshake

get_network_entity_info — Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname. A hostname is resolved to an IP for the GeoIP lookup (`resolved_ip`, when resolu
arp_lookup — Performs an ARP lookup to find the MAC address for a given Local IP address. A suitable network interface is automatically selected. The list of all suitable in
ping — Ping a target host from the Netmon server. Wraps POST /api/getPingInfo/{target} (permission: tools). The probe runs ON the netmon server, not on the mcpmond ho
traceroute — Traceroute to a target from the Netmon server. Wraps POST /api/getTracerouteInfo/{target} (permission: tools). The probe runs ON the netmon server — hops refle
port_map — Nmap port scan against a single host from the Netmon server. Wraps POST /api/getPortscanInfo (permission: tools). Server runs `nmap -oX - -p <ports> --open <ip
search_ip — Find every mention of a specific IP across Netmon's log and telemetry streams: syslog, Windows eventlog, Suricata EVE, aggregated NetFlow, and ARP. Returns one
syslog_search — Search syslog messages from network devices. Wraps GET /api/syslog/list (permission: logs); tag-scoped server-side. Filters (all optional): device_id, severity
eventlog_search — Search Windows Event Log entries ingested from Netmon agents. Wraps GET /api/eventlog/list (permission: logs); tag-scoped server-side. Severity is the raw Wind
eve_search — Search Suricata EVE-format IDS events. Wraps GET /api/eve/list (permission: logs); tag-scoped server-side. Severity is Suricata-native: 1=high, 2=medium, 3=low
eve_get — Fetch a single Suricata EVE event by id, decoded server-side. Wraps GET /api/eve/get/{id} (requires permission: logs). Returns an envelope: summary (signature/c
log_severity_summary — Count log events grouped by severity over a time window. One tool, three backends — pass `stream` to pick which. stream='syslog' → wraps /api/syslog/sevSum
syslog_facets — Top-N value counts for ONE syslog field over a window — 'what are the top actions/reasons on this FortiGate in the last 2 hours' in a single call, instead of pu
netflow_search — Search the FULL NetFlow history: the raw flow table (the last ~15 minutes) unioned with the aggregated rollup (4 weeks of history), windowed and pro-rated serve
netflow_raw_search — Search raw NetFlow records (per-flow, not aggregated). Wraps GET /api/netflow/list (permission: vne). HORIZON — read this before choosing a window: the raw tab
flow_summary — Summarize one host's network conversations: top peers, top ports, and a client-vs-service-side split, each with a residual "other" bucket plus overall totals. W
device_list — List monitored devices. Wraps GET /api/devices (permission: devices); user's tag-scope is enforced server-side. Filters (all optional, combinable): - tag: ta
device_get — Fetch one device with its related state: tags, alerts, the ping / oid / interface / port / disk trackers configured on it, its SNMP walk trackers, and a netflow
device_find — Find devices matching a substring of label or ip_address. Convenience wrapper for GET /api/devices?search=<q>; equivalent to device_list({search: q}). Use devi
overwatch_summary — High-level network health snapshot for 'how's the network?' style questions. Wraps GET /api/devices?alerts=1&tags=1 (requires permission: devices) and aggregate
snmp_test — Probe a device for SNMP reachability using the Netmon snmptest binary. Wraps POST /api/testSnmp (requires permission: write_devices). BLOCKING — can run up to 6
snmp_walk_last — Fetch the most recent stored SNMP walk for a device (cached in tools_walks). Wraps GET /api/getLastWalk/{device} (permission: tools). Cheap single-row read. Al
snmp_walk_run — Trigger a FRESH SNMP walk against a device. Wraps POST /api/getSNMPWalkInfo/{deviceId} (permission: tools). SLOW and SIDE-EFFECTING. Server-side this shells ou
agent_services — List Windows services on an agent-managed device — live read via the WMI tunnel. Wraps POST /api/getDeviceServices (permission: devices). Returns rows of {Name
agent_processes — List running processes on an agent-managed device — live read via the agent tunnel. Wraps POST /api/getDeviceProcesses (permission: devices). Returns rows as r
alerts_list — List configured alert definitions across both axes of the rule engine. Modern alerts (table `alerts`, class-scoped: syslog_log / event_log / eve_log / device_do
alerts_history — Authoritative 'what fired and when' stream — wraps the `alert_history` table (one row per incident, both legacy and modern) and `alert_outlet_log` (per-dispatch
maintenance_windows_list — Lists maintenance windows — the suppression schedules that gate alert dispatch. Use when a user asks 'why didn't this page me' or 'is this device under maintena
tags_list — List tag definitions. The slug is the stable identifier used everywhere device-tag scoping is enforced (e.g. alert_routing_rules.tag_filters, device_list({tag:
top_bandwidth — Top NetFlow conversations over the last N minutes — the 'who's eating bandwidth right now?' question. Wraps GET /api/getTopBandwidth/{mins}, the same query that
arp_table — Lists hosts observed on the local LAN(s) via the ARP table — the 'what devices have we seen recently?' question. Wraps POST /api/getArpTable, which collapses ar
interfaces_search — Cross-device interface metadata listing — answers 'what interfaces are tracked across the fleet, named like X, on device Y?'. Wraps GET /api/interfaces/all, whi
device_metric_summary — Day / week / month / all-time summary stats for a single device-tracker, by metric type. Multi-backend: pass `metric` to pick which upstream endpoint to hit. m
agent_disk_usage — Path-scoped folder-tree disk usage report from a Netmon agent — the 'D: drive is at 95%, what's eating it?' question. Wraps POST /api/getFolderUsageFromPath whi
capture_list — Read-only listing of packet captures. Wraps GET /api/captures. Operators see their own captures; admin (sa) sees all. The upstream endpoint returns the 200 most
capture_get — Read-only single-capture detail. Wraps GET /api/captures/{id}. If the capture is still active (status=starting|running) the upstream endpoint refreshes status f
speedtest_history — Recent WAN speedtest results — answers 'is the internet healthy?'. Wraps GET /api/getSpeedTestHistory. Returns rows ordered by timestamp desc. Each row carries

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registrycom.netmon/netmon

first seen 1 mo ago · fetched 2 d agoopen ↗

Field history (12 recent events)

15 d ago · declared · description → "Query devices, alerts, syslog, Suricata IDS, NetFlow and captures on your Netmon appliance."
15 d ago · declared · summary → "Query devices, alerts, syslog, Suricata IDS, NetFlow and captures on your Netmon appliance."
15 d ago · declared · name → "Netmon"
15 d ago · declared · version → "0.1.9"
16 d ago · declared · name → "Netmon (demo)"
16 d ago · declared · version → "1.0.1"
16 d ago · declared · summary → "Public read-only demo of Netmon's network monitoring tools over a recorded snapshot."
16 d ago · declared · description → "Public read-only demo of Netmon's network monitoring tools over a recorded snapshot."
29 d ago · declared · repoUrl → "https://github.com/Netmon-Services/netmon-mcpd"
29 d ago · declared · summary → "Query devices, alerts, syslog, Suricata IDS, NetFlow and captures on your Netmon appliance."
29 d ago · declared · description → "Query devices, alerts, syslog, Suricata IDS, NetFlow and captures on your Netmon appliance."
29 d ago · declared · homepageUrl → "https://netmon.com/mcp-server/"

when	check	result	http	latency	detail
15 d ago	mcp initialize	ok	200	85 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
15 d ago	mcp initialize	ok	200	86 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
16 d ago	mcp initialize	ok	200	100 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
16 d ago	mcp initialize	ok	200	87 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
16 d ago	mcp initialize	ok	200	84 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
16 d ago	mcp initialize	ok	200	95 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
17 d ago	mcp initialize	ok	200	100 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
17 d ago	mcp initialize	ok	200	87 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
17 d ago	mcp initialize	ok	200	100 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
17 d ago	mcp initialize	ok	200	84 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools

Netmon

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from