Netmon (demo)

Name: Netmon (demo)
Author: com.netmon

MCP serverMCP

Public read-only demo of Netmon's network monitoring tools over a recorded snapshot.

Listed on its own since 2026-09-26. Until then it was part of netmon, where its earlier checks remain.

by com.netmonrepository ↗homepage ↗v1.0.1

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"netmon-demo","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability52/52 checks ok

Endpoints

https://netmon.com/mcp-demo/mcpmcp streamable http · checked on a schedule

Registry facts

Not distributed through a package registry we index.

when	check	result	http	latency	detail
2 h ago	mcp initialize	ok	200	134 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
8 h ago	mcp initialize	ok	200	85 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
15 h ago	mcp initialize	ok	200	99 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
22 h ago	mcp initialize	ok	200	100 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
29 h ago	mcp initialize	ok	200	92 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
35 h ago	mcp initialize	ok	200	100 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
2 d ago	mcp initialize	ok	200	114 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
2 d ago	mcp initialize	ok	200	85 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
2 d ago	mcp initialize	ok	200	95 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools
3 d ago	mcp initialize	ok	200	115 ms	server netmon7-demo 1.0.0 · protocol 2025-06-18 · 36 tools

Tools observed via MCP handshake

get_network_entity_info — Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname. A hostname is resolved to an IP for the GeoIP lookup (`resolved_ip`, when resolu
arp_lookup — Performs an ARP lookup to find the MAC address for a given Local IP address. A suitable network interface is automatically selected. The list of all suitable in
ping — Ping a target host from the Netmon server. Wraps POST /api/getPingInfo/{target} (permission: tools). The probe runs ON the netmon server, not on the mcpmond ho
traceroute — Traceroute to a target from the Netmon server. Wraps POST /api/getTracerouteInfo/{target} (permission: tools). The probe runs ON the netmon server — hops refle
port_map — Nmap port scan against a single host from the Netmon server. Wraps POST /api/getPortscanInfo (permission: tools). Server runs `nmap -oX - -p <ports> --open <ip
search_ip — Find every mention of a specific IP across Netmon's log and telemetry streams: syslog, Windows eventlog, Suricata EVE, aggregated NetFlow, and ARP. Returns one
syslog_search — Search syslog messages from network devices. Wraps GET /api/syslog/list (permission: logs); tag-scoped server-side. Filters (all optional): device_id, severity
eventlog_search — Search Windows Event Log entries ingested from Netmon agents. Wraps GET /api/eventlog/list (permission: logs); tag-scoped server-side. Severity is the raw Wind
eve_search — Search Suricata EVE-format IDS events. Wraps GET /api/eve/list (permission: logs); tag-scoped server-side. Severity is Suricata-native: 1=high, 2=medium, 3=low
eve_get — Fetch a single Suricata EVE event by id, decoded server-side. Wraps GET /api/eve/get/{id} (requires permission: logs). Returns an envelope: summary (signature/c
log_severity_summary — Count log events grouped by severity over a time window. One tool, three backends — pass `stream` to pick which. stream='syslog' → wraps /api/syslog/sevSum
syslog_facets — Top-N value counts for ONE syslog field over a window — 'what are the top actions/reasons on this FortiGate in the last 2 hours' in a single call, instead of pu
netflow_search — Search the FULL NetFlow history: the raw flow table (the last ~15 minutes) unioned with the aggregated rollup (4 weeks of history), windowed and pro-rated serve
netflow_raw_search — Search raw NetFlow records (per-flow, not aggregated). Wraps GET /api/netflow/list (permission: vne). HORIZON — read this before choosing a window: the raw tab
flow_summary — Summarize one host's network conversations: top peers, top ports, and a client-vs-service-side split, each with a residual "other" bucket plus overall totals. W
device_list — List monitored devices. Wraps GET /api/devices (permission: devices); user's tag-scope is enforced server-side. Filters (all optional, combinable): - tag: ta
device_get — Fetch one device with its related state: tags, alerts, the ping / oid / interface / port / disk trackers configured on it, its SNMP walk trackers, and a netflow
device_find — Find devices matching a substring of label or ip_address. Convenience wrapper for GET /api/devices?search=<q>; equivalent to device_list({search: q}). Use devi
overwatch_summary — High-level network health snapshot for 'how's the network?' style questions. Wraps GET /api/devices?alerts=1&tags=1 (requires permission: devices) and aggregate
snmp_test — Probe a device for SNMP reachability using the Netmon snmptest binary. Wraps POST /api/testSnmp (requires permission: write_devices). BLOCKING — can run up to 6
snmp_walk_last — Fetch the most recent stored SNMP walk for a device (cached in tools_walks). Wraps GET /api/getLastWalk/{device} (permission: tools). Cheap single-row read. Al
snmp_walk_run — Trigger a FRESH SNMP walk against a device. Wraps POST /api/getSNMPWalkInfo/{deviceId} (permission: tools). SLOW and SIDE-EFFECTING. Server-side this shells ou
agent_services — List Windows services on an agent-managed device — live read via the WMI tunnel. Wraps POST /api/getDeviceServices (permission: devices). Returns rows of {Name
agent_processes — List running processes on an agent-managed device — live read via the agent tunnel. Wraps POST /api/getDeviceProcesses (permission: devices). Returns rows as r
alerts_list — List configured alert definitions across both axes of the rule engine. Modern alerts (table `alerts`, class-scoped: syslog_log / event_log / eve_log / device_do
alerts_history — Authoritative 'what fired and when' stream — wraps the `alert_history` table (one row per incident, both legacy and modern) and `alert_outlet_log` (per-dispatch
maintenance_windows_list — Lists maintenance windows — the suppression schedules that gate alert dispatch. Use when a user asks 'why didn't this page me' or 'is this device under maintena
tags_list — List tag definitions. The slug is the stable identifier used everywhere device-tag scoping is enforced (e.g. alert_routing_rules.tag_filters, device_list({tag:
top_bandwidth — Top NetFlow conversations over the last N minutes — the 'who's eating bandwidth right now?' question. Wraps GET /api/getTopBandwidth/{mins}, the same query that
arp_table — Lists hosts observed on the local LAN(s) via the ARP table — the 'what devices have we seen recently?' question. Wraps POST /api/getArpTable, which collapses ar
interfaces_search — Cross-device interface metadata listing — answers 'what interfaces are tracked across the fleet, named like X, on device Y?'. Wraps GET /api/interfaces/all, whi
device_metric_summary — Day / week / month / all-time summary stats for a single device-tracker, by metric type. Multi-backend: pass `metric` to pick which upstream endpoint to hit. m
agent_disk_usage — Path-scoped folder-tree disk usage report from a Netmon agent — the 'D: drive is at 95%, what's eating it?' question. Wraps POST /api/getFolderUsageFromPath whi
capture_list — Read-only listing of packet captures. Wraps GET /api/captures. Operators see their own captures; admin (sa) sees all. The upstream endpoint returns the 200 most
capture_get — Read-only single-capture detail. Wraps GET /api/captures/{id}. If the capture is still active (status=starting|running) the upstream endpoint refreshes status f
speedtest_history — Recent WAN speedtest results — answers 'is the internet healthy?'. Wraps GET /api/getSpeedTestHistory. Returns rows ordered by timestamp desc. Each row carries

Declared by sources

What the publisher says

Attributed to the source that supplied each field. Treated as claims, not facts.

No long description beyond the summary.

kind Official MCP Registry

name Official MCP Registry

repoUrl Official MCP Registry

summary Official MCP Registry

version Official MCP Registry

description Official MCP Registry

homepageUrl Official MCP Registry

publisherName Official MCP Registry

Derived by Wellknown

Capabilities

Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.

content.writingWriting & Editing100%dev.monitoringMonitoring & Observability90%automation.workflowsWorkflow Automation51%

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registrycom.netmon/netmon-demo

first seen 29 d ago · fetched 25 h agoopen ↗

Field history (7 recent events)

14 d ago · declared · summary → "Public read-only demo of Netmon's network monitoring tools over a recorded snapshot."
14 d ago · declared · description → "Public read-only demo of Netmon's network monitoring tools over a recorded snapshot."
14 d ago · declared · publisherName → "com.netmon"
14 d ago · declared · homepageUrl → "https://netmon.com/mcp-server/"
14 d ago · declared · repoUrl → "https://github.com/Netmon-Services/netmon-mcpd"
14 d ago · declared · version → "1.0.1"
14 d ago · declared · protocols → ["mcp"]