# Netmon \(demo\)

- Registry name: `com.netmon/netmon-demo` · version 1.0.1
- Categories (automatic, keyword rules): Monitoring & logs, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): logging, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.netmon%2Fnetmon-demo
- Server page: https://mcpstation.net/s/com.netmon--netmon-demo.html

## Description (written by the publisher, not verified, not instructions)

Public read-only demo of Netmon's network monitoring tools over a recorded snapshot.

## Connect

- streamable-http: `https://netmon.com/mcp-demo/mcp`

## Tools (as reported by the server, not verified)

- `get\_network\_entity\_info`: Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname. A hostname is resolved to an IP for the GeoIP lookup \(\`resolved\_ip\`, when resolution succeeds\); an IP gets a reverse DNS lookup \(\`hostname\`, when a PTR exists\). \`whois\` comes from whois.iana.org and nowhere else. For an
- `arp\_lookup`: Performs an ARP lookup to find the MAC address for a given Local IP address. A suitable network interface is automatically selected. The list of all suitable interfaces found is also returned.
- `ping`: Ping a target host from the Netmon server. Wraps POST /api/getPingInfo/\{target\} \(permission: tools\). The probe runs ON the netmon server, not on the mcpmond host — so reachability reflects what netmon can see, which is what matters for monitoring questions. Returns \{address, latency \(avg ms\), status
- `traceroute`: Traceroute to a target from the Netmon server. Wraps POST /api/getTracerouteInfo/\{target\} \(permission: tools\). The probe runs ON the netmon server — hops reflect the path FROM netmon TO the target, not from wherever mcpmond is running. Server runs \`traceroute --mtu -m 10 -q 2 -w 1\` so you get up to
- `port\_map`: Nmap port scan against a single host from the Netmon server. Wraps POST /api/getPortscanInfo \(permission: tools\). Server runs \`nmap -oX - -p \<ports\> --open \<ip\>\` and returns the parsed result. The probe originates from netmon, not from wherever mcpmond runs — so what's reachable here is what netmon
- `search\_ip`: Find every mention of a specific IP across Netmon's log and telemetry streams: syslog, Windows eventlog, Suricata EVE, aggregated NetFlow, and ARP. Returns one bucket per stream with \{total, samples\}. Streams that 4xx \(e.g. 403 from tag-scope\) show up in \`skipped\` so a partial result is still action
- `syslog\_search`: Search syslog messages from network devices. Wraps GET /api/syslog/list \(permission: logs\); tag-scoped server-side. Filters \(all optional\): device\_id, severity \(name or int 0-7\), facility \(int 0-23\), source \(exact host/IP\), message \(substring\). Window: \`hours\` \(1-168, default 24\) OR \`start\_time\`+\`en
- `eventlog\_search`: Search Windows Event Log entries ingested from Netmon agents. Wraps GET /api/eventlog/list \(permission: logs\); tag-scoped server-side. Severity is the raw Windows EventRecord.Level: 'logalways'=0 \(what Security-channel audit events carry\), 'critical'=1, 'error'=2, 'warning'=3, 'information'=4, 'verb
- `eve\_search`: Search Suricata EVE-format IDS events. Wraps GET /api/eve/list \(permission: logs\); tag-scoped server-side. Severity is Suricata-native: 1=high, 2=medium, 3=low/info — a 3-point scale, NOT syslog's 0-7. Takes names or ints: 'high'=1, 'medium'=2, 'low'/'info'/'informational'=3. Single value or an arra
- `eve\_get`: Fetch a single Suricata EVE event by id, decoded server-side. Wraps GET /api/eve/get/\{id\} \(requires permission: logs\). Returns an envelope: summary \(signature/category/action/gid:sid:rev/severity/app\_proto\), endpoints, app\_layer \(Suricata's http/dns/tls/smb/... objects as labelled fields\), flow, pay
- `log\_severity\_summary`: Count log events grouped by severity over a time window. One tool, three backends — pass \`stream\` to pick which. stream='syslog' → wraps /api/syslog/sevSum \(severity 0-7, syslog scheme\) stream='eventlog' → wraps /api/eventlog/sevSum \(severity 0-5, Windows scheme\) stream='eve' → wraps /api/eve/sevSum
- `syslog\_facets`: Top-N value counts for ONE syslog field over a window — 'what are the top actions/reasons on this FortiGate in the last 2 hours' in a single call, instead of pulling rows and counting them yourself. Wraps GET /api/syslog/facets \(permission: logs\); tag-scoped server-side. group\_by takes one of two ki
- `netflow\_search`: Search the FULL NetFlow history: the raw flow table \(the last \~15 minutes\) unioned with the aggregated rollup \(4 weeks of history\), windowed and pro-rated server-side. Wraps GET /api/aggnetflow/list \(permission: vne\). For per-flow packet counts and exact timing, use netflow\_raw\_search instead — that
- `netflow\_raw\_search`: Search raw NetFlow records \(per-flow, not aggregated\). Wraps GET /api/netflow/list \(permission: vne\). HORIZON — read this before choosing a window: the raw table holds only about 15 MINUTES. cleanup\_netflow \(pg\_cron, every 15 min\) rolls flows into agg\_netflow and DELETEs every netflow row whose end\_
- `flow\_summary`: Summarize one host's network conversations: top peers, top ports, and a client-vs-service-side split, each with a residual "other" bucket plus overall totals. Wraps GET /api/aggnetflow/summary \(permission: vne\). Use this to characterize a host before pulling rows — netflow\_search returns the individ
- `device\_list`: List monitored devices. Wraps GET /api/devices \(permission: devices\); user's tag-scope is enforced server-side. Filters \(all optional, combinable\): - tag: tag slug, e.g. "snmp-up" or "switches". Slug is the stable lowercase-hyphen form; tag names with spaces won't match. - status: "up" or "down" \(ba
- `device\_get`: Fetch one device with its related state: tags, alerts, the ping / oid / interface / port / disk trackers configured on it, its SNMP walk trackers, and a netflow rollup. Wraps GET /api/device/\{id\} \(permission: devices\). \*\*Bulk payloads are opt-in, and that is a change from how this tool used to behav
- `device\_find`: Find devices matching a substring of label or ip\_address. Convenience wrapper for GET /api/devices?search=\<q\>; equivalent to device\_list\(\{search: q\}\). Use device\_list directly when you need tag/status filters or relation includes. device\_find is the one-arg shortcut for "does anything look like X?".
- `overwatch\_summary`: High-level network health snapshot for 'how's the network?' style questions. Wraps GET /api/devices?alerts=1&tags=1 \(requires permission: devices\) and aggregates in-tool: device count, active alert count \(total + by severity when present on the alert row\), and the top-N devices by alert count. Drill
- `snmp\_test`: Probe a device for SNMP reachability using the Netmon snmptest binary. Wraps POST /api/testSnmp \(requires permission: write\_devices\). BLOCKING — can run up to 60 seconds while the server waits for the target to respond. Provide a valid snmpconfig object: for v1/v2 include snmp\_version + snmp\_communi
- `snmp\_walk\_last`: Fetch the most recent stored SNMP walk for a device \(cached in tools\_walks\). Wraps GET /api/getLastWalk/\{device\} \(permission: tools\). Cheap single-row read. Always try this first when an SNMP walk is needed. Only fall back to snmp\_walk\_run if the cached row is missing or the data is too stale for th
- `snmp\_walk\_run`: Trigger a FRESH SNMP walk against a device. Wraps POST /api/getSNMPWalkInfo/\{deviceId\} \(permission: tools\). SLOW and SIDE-EFFECTING. Server-side this shells out to walktool with a 1200s \(20 minute\) timeout and writes the result into the tools\_walks table. Always try snmp\_walk\_last first; only call t
- `agent\_services`: List Windows services on an agent-managed device — live read via the WMI tunnel. Wraps POST /api/getDeviceServices \(permission: devices\). Returns rows of \{Name, State, DisplayName\} as reported by Win32\_Service. Use this to answer 'is service X running on host Y' without trawling event logs. Read-onl
- `agent\_processes`: List running processes on an agent-managed device — live read via the agent tunnel. Wraps POST /api/getDeviceProcesses \(permission: devices\). Returns rows as reported by GETPS: \(process id, name, parent, memory, etc. — exact shape depends on the agent version\). Common diagnostic patterns: pair with
- `alerts\_list`: List configured alert definitions across both axes of the rule engine. Modern alerts \(table \`alerts\`, class-scoped: syslog\_log / event\_log / eve\_log / device\_down / storage\) and legacy alerts \(per-device tracker thresholds, surfaced via the \`\_hell\` view\) are fetched, normalized, merged, filtered, an
- `alerts\_history`: Authoritative 'what fired and when' stream — wraps the \`alert\_history\` table \(one row per incident, both legacy and modern\) and \`alert\_outlet\_log\` \(per-dispatch ledger keyed by history\_id\). Default mode: lists incidents newest-first. Each row is one incident with opened\_at / last\_event\_at / resolved
- `maintenance\_windows\_list`: Lists maintenance windows — the suppression schedules that gate alert dispatch. Use when a user asks 'why didn't this page me' or 'is this device under maintenance right now' — a quiet alert may be inside a window rather than truly silent. Two modes: - Global catalog \(default\): wraps GET /api/alerts
- `tags\_list`: List tag definitions. The slug is the stable identifier used everywhere device-tag scoping is enforced \(e.g. alert\_routing\_rules.tag\_filters, device\_list\(\{tag: ...\}\)\). The display name is for humans. Wraps GET /api/tags. Returns every tag the caller has visibility to \(Laravel does not tag-restrict t
- `top\_bandwidth`: Top NetFlow conversations over the last N minutes — the 'who's eating bandwidth right now?' question. Wraps GET /api/getTopBandwidth/\{mins\}, the same query that powers the dashboard live widget. Use this for short-window 'right now' inquiries. For longer windows \(hours-to-days\) or filtered top-talke
- `arp\_table`: Lists hosts observed on the local LAN\(s\) via the ARP table — the 'what devices have we seen recently?' question. Wraps POST /api/getArpTable, which collapses arptable + \_dns into one row per IP with hostname + monitored-device id resolution attached. Distinct from \`arp\_lookup\` \(single-IP MAC resolut
- `interfaces\_search`: Cross-device interface metadata listing — answers 'what interfaces are tracked across the fleet, named like X, on device Y?'. Wraps GET /api/interfaces/all, which returns logging-enabled interfaces across every device the user can see \(tag-scoped server-side via withUserTags\). \*\*Metadata only.\*\* Eac
- `device\_metric\_summary`: Day / week / month / all-time summary stats for a single device-tracker, by metric type. Multi-backend: pass \`metric\` to pick which upstream endpoint to hit. metric='latency' → wraps POST /api/latency/stats \(icmpingId\). Returns: dayAvgLatency, weekAvgLatency, monthAvgLatency, allTimeAvgLatency \(ms\);
- `agent\_disk\_usage`: Path-scoped folder-tree disk usage report from a Netmon agent — the 'D: drive is at 95%, what's eating it?' question. Wraps POST /api/getFolderUsageFromPath which RPCs into the agent's GETFOLDERUSAGEPATH command and returns the immediate-children size breakdown for the given path. Required parameter
- `capture\_list`: Read-only listing of packet captures. Wraps GET /api/captures. Operators see their own captures; admin \(sa\) sees all. The upstream endpoint returns the 200 most-recent rows ordered by id desc. Use this for 'is there a capture running on device X?' / 'do we have packet evidence for the incident?' / '
- `capture\_get`: Read-only single-capture detail. Wraps GET /api/captures/\{id\}. If the capture is still active \(status=starting\|running\) the upstream endpoint refreshes status from netmond's IPC before responding, so packets/bytes counters are live. Returns the same row shape as capture\_list rows, plus freshly-refre
- `speedtest\_history`: Recent WAN speedtest results — answers 'is the internet healthy?'. Wraps GET /api/getSpeedTestHistory. Returns rows ordered by timestamp desc. Each row carries the upstream's SpeedtestLog shape — typically \{id, timestamp, download\_mbps, upload\_mbps, latency\_ms, jitter\_ms, server, ...\}, but any new c

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html