Netmon (demo)
Public read-only demo of Netmon's network monitoring tools over a recorded snapshot.
| Endpoint | https://netmon.com/mcp-demo/mcp (streamable-http) |
|---|---|
| Registry version | 1.0.1 |
| Now | 36 tools · grade F (43) · pin ts_2b347276397eb6302634c49dcd138eda · protocol 2025-06-18 |
| First / last listed | 2026-11-01 03:13 UTC / 2026-11-01 03:13 UTC |
| Grade over time | 2026-11-01: F (43), 36 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: get_network_entity_info arp_lookup ping traceroute port_map search_ip syslog_search eventlog_search eve_search eve_get log_severity_summary syslog_facets netflow_search netflow_raw_search flow_summary device_list device_get device_find overwatch_summary snmp_test snmp_walk_last snmp_walk_run agent_services agent_processes alerts_list alerts_history maintenance_windows_list tags_list top_bandwidth arp_table interfaces_search device_metric_summary agent_disk_usage capture_list capture_get speedtest_history
get_network_entity_info | Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname. A hostname is resolved to an IP for the GeoIP lookup (`resolved_ip`, when resolution succeeds); an IP gets a reverse DNS lookup (`hostname`, when a PTR exists).
`whois` comes from whois.iana.org and nowhere else. For an address IANA returns the RIR referral record, so its `organisation` is the regional registry that a params: entity_identifier* |
arp_lookup | Performs an ARP lookup to find the MAC address for a given Local IP address. A suitable network interface is automatically selected. The list of all suitable interfaces found is also returned. params: target_ip* |
ping | Ping a target host from the Netmon server. Wraps POST /api/getPingInfo/{target} (permission: tools).
The probe runs ON the netmon server, not on the mcpmond host — so reachability reflects what netmon can see, which is what matters for monitoring questions.
Returns {address, latency (avg ms), status (true=reachable), hostname (PTR lookup; falls back to the bare address when the host has no rever params: target* |
traceroute | Traceroute to a target from the Netmon server. Wraps POST /api/getTracerouteInfo/{target} (permission: tools).
The probe runs ON the netmon server — hops reflect the path FROM netmon TO the target, not from wherever mcpmond is running. Server runs `traceroute --mtu -m 10 -q 2 -w 1` so you get up to 10 hops with MTU discovery; longer paths get truncated. PTR lookups happen server-side.
Returns ro params: target* |
port_map | Nmap port scan against a single host from the Netmon server. Wraps POST /api/getPortscanInfo (permission: tools).
Server runs `nmap -oX - -p <ports> --open <ip>` and returns the parsed result. The probe originates from netmon, not from wherever mcpmond runs — so what's reachable here is what netmon can reach.
Single targets only (single IP or hostname). The backing endpoint does not accept CIDR params: port_range, target* |
search_ip | Find every mention of a specific IP across Netmon's log and telemetry streams: syslog, Windows eventlog, Suricata EVE, aggregated NetFlow, and ARP.
Returns one bucket per stream with {total, samples}. Streams that 4xx (e.g. 403 from tag-scope) show up in `skipped` so a partial result is still actionable. The syslog/eventlog streams match the IP via an unindexed message substring scan; on a high-v params: hours, ip*, per_stream, streams |
syslog_search | Search syslog messages from network devices. Wraps GET /api/syslog/list (permission: logs); tag-scoped server-side.
Filters (all optional): device_id, severity (name or int 0-7), facility (int 0-23), source (exact host/IP), message (substring).
Window: `hours` (1-168, default 24) OR `start_time`+`end_time` (ISO-8601 UTC). `limit` defaults to 50 (max 500). The response's `total` is the full match params: device_id, end_time, facility, hours, limit, message, severity, source, start_time |
eventlog_search | Search Windows Event Log entries ingested from Netmon agents. Wraps GET /api/eventlog/list (permission: logs); tag-scoped server-side.
Severity is the raw Windows EventRecord.Level: 'logalways'=0 (what Security-channel audit events carry), 'critical'=1, 'error'=2, 'warning'=3, 'information'=4, 'verbose'=5 — pass names or ints. Note 0 is NOT Information.
Window: `hours` (1-168, default 24) OR `st params: device_id, end_time, event_id, hours, limit, log, message, severity, source, start_time |
eve_search | Search Suricata EVE-format IDS events. Wraps GET /api/eve/list (permission: logs); tag-scoped server-side.
Severity is Suricata-native: 1=high, 2=medium, 3=low/info — a 3-point scale, NOT syslog's 0-7. Takes names or ints: 'high'=1, 'medium'=2, 'low'/'info'/'informational'=3. Single value or an array, which may mix the two forms (e.g. ["high", 2]).
IP filters: passing only src_ip or only dst_ip params: device_id, dst_ip, dst_port, end_time, hours, iface, limit, proto, severity, signature_id, src_ip, src_port, start_time, vlan |
eve_get | Fetch a single Suricata EVE event by id, decoded server-side. Wraps GET /api/eve/get/{id} (requires permission: logs). Returns an envelope: summary (signature/category/action/gid:sid:rev/severity/app_proto), endpoints, app_layer (Suricata's http/dns/tls/smb/... objects as labelled fields), flow, payload (printable text + length; the base64 bytes are omitted here), decoded (protocol-aware parse of params: id* |
log_severity_summary | Count log events grouped by severity over a time window. One tool, three backends — pass `stream` to pick which.
stream='syslog' → wraps /api/syslog/sevSum (severity 0-7, syslog scheme)
stream='eventlog' → wraps /api/eventlog/sevSum (severity 0-5, Windows scheme)
stream='eve' → wraps /api/eve/sevSum (severity 1-3, Suricata scheme)
Use this for triage before pulling rows: 'how many params: device_id, end_time, hours, start_time, stream* |
syslog_facets | Top-N value counts for ONE syslog field over a window — 'what are the top actions/reasons on this FortiGate in the last 2 hours' in a single call, instead of pulling rows and counting them yourself. Wraps GET /api/syslog/facets (permission: logs); tag-scoped server-side.
group_by takes one of two kinds of field:
COLUMN (indexed, may run fleet-wide — device_id optional):
facility, severity, params: device_id, end_time, group_by*, hours, limit, start_time |
netflow_search | Search the FULL NetFlow history: the raw flow table (the last ~15 minutes) unioned with the aggregated rollup (4 weeks of history), windowed and pro-rated server-side. Wraps GET /api/aggnetflow/list (permission: vne). For per-flow packet counts and exact timing, use netflow_raw_search instead — that's the right drill-down once this tool surfaces an interesting src/dst pair, but it only reaches bac params: dst_ip, dst_port, end_time, flow_src, hours, in_iface, ip, limit, out_iface, port, protocol, src_ip, src_port, start_time, vlan |
netflow_raw_search | Search raw NetFlow records (per-flow, not aggregated). Wraps GET /api/netflow/list (permission: vne).
HORIZON — read this before choosing a window: the raw table holds only about 15 MINUTES. cleanup_netflow (pg_cron, every 15 min) rolls flows into agg_netflow and DELETEs every netflow row whose end_time is older than 15 minutes. `hours` accepts 1-168, but no data older than that horizon exists to params: dst_ip, dst_port, end_time, flow_src, hours, in_iface, ip, limit, out_iface, port, protocol, src_ip, src_port, start_time, vlan |
flow_summary | Summarize one host's network conversations: top peers, top ports, and a client-vs-service-side split, each with a residual "other" bucket plus overall totals. Wraps GET /api/aggnetflow/summary (permission: vne). Use this to characterize a host before pulling rows — netflow_search returns the individual conversations once a rollup here points at an interesting peer or port.
Source is the windowed params: end_time, hours, ip*, limit, start_time |
device_list | List monitored devices. Wraps GET /api/devices (permission: devices); user's tag-scope is enforced server-side.
Filters (all optional, combinable):
- tag: tag slug, e.g. "snmp-up" or "switches". Slug is the stable lowercase-hyphen form; tag names with spaces won't match.
- status: "up" or "down" (based on latest ping).
- search: substring match on label + ip_address (case-insensitive).
Rel params: alerts, disks, interfaces, oids, page, per_page, ping, ports, search, status, tag, tags, walks |
device_get | Fetch one device with its related state: tags, alerts, the ping / oid / interface / port / disk trackers configured on it, its SNMP walk trackers, and a netflow rollup. Wraps GET /api/device/{id} (permission: devices).
**Bulk payloads are opt-in, and that is a change from how this tool used to behave.** It returned every log row every tracker collected in the window, inline: one 8-hour call on an params: end_time, hours, id*, include_logs, include_walk_data, max_log_rows, start_time |
device_find | Find devices matching a substring of label or ip_address. Convenience wrapper for GET /api/devices?search=<q>; equivalent to device_list({search: q}).
Use device_list directly when you need tag/status filters or relation includes. device_find is the one-arg shortcut for "does anything look like X?".
Pagination: per_page defaults to 25 (max 200), page defaults to 1. Permission: devices.
Example: params: page, per_page, q* |
overwatch_summary | High-level network health snapshot for 'how's the network?' style questions. Wraps GET /api/devices?alerts=1&tags=1 (requires permission: devices) and aggregates in-tool: device count, active alert count (total + by severity when present on the alert row), and the top-N devices by alert count. Drill into specific devices with device_get. params: top_n |
snmp_test | Probe a device for SNMP reachability using the Netmon snmptest binary. Wraps POST /api/testSnmp (requires permission: write_devices). BLOCKING — can run up to 60 seconds while the server waits for the target to respond. Provide a valid snmpconfig object: for v1/v2 include snmp_version + snmp_community; for v3 include snmp_version=3 plus authuser/authpass/authprot and optionally privpass/privprot a params: ip*, snmpconfig* |
snmp_walk_last | Fetch the most recent stored SNMP walk for a device (cached in tools_walks). Wraps GET /api/getLastWalk/{device} (permission: tools). Cheap single-row read.
Always try this first when an SNMP walk is needed. Only fall back to snmp_walk_run if the cached row is missing or the data is too stale for the question (the controller does not stamp a freshness header — judge from the walk's own timestamps params: device_id* |
snmp_walk_run | Trigger a FRESH SNMP walk against a device. Wraps POST /api/getSNMPWalkInfo/{deviceId} (permission: tools).
SLOW and SIDE-EFFECTING. Server-side this shells out to walktool with a 1200s (20 minute) timeout and writes the result into the tools_walks table. Always try snmp_walk_last first; only call this when the cached walk is missing or known to be stale.
MCP tool timeout is 1200s to match the s params: device_id* |
agent_services | List Windows services on an agent-managed device — live read via the WMI tunnel. Wraps POST /api/getDeviceServices (permission: devices).
Returns rows of {Name, State, DisplayName} as reported by Win32_Service. Use this to answer 'is service X running on host Y' without trawling event logs. Read-only by design — the service-control endpoints (start/stop/restart) are deliberately NOT exposed via m params: device_id* |
agent_processes | List running processes on an agent-managed device — live read via the agent tunnel. Wraps POST /api/getDeviceProcesses (permission: devices).
Returns rows as reported by GETPS: (process id, name, parent, memory, etc. — exact shape depends on the agent version).
Common diagnostic patterns: pair with agent_services to answer 'is the SQL Server service running but stuck?'; correlate top memory/cpu params: device_id* |
alerts_list | List configured alert definitions across both axes of the rule engine. Modern alerts (table `alerts`, class-scoped: syslog_log / event_log / eve_log / device_down / storage) and legacy alerts (per-device tracker thresholds, surfaced via the `_hell` view) are fetched, normalized, merged, filtered, and paginated.
Wraps GET /api/alerts (modern) and POST /api/getAlerts (legacy). Both endpoints return params: class, device_id, enabled, page, per_page, scope, search, severity |
alerts_history | Authoritative 'what fired and when' stream — wraps the `alert_history` table (one row per incident, both legacy and modern) and `alert_outlet_log` (per-dispatch ledger keyed by history_id).
Default mode: lists incidents newest-first. Each row is one incident with opened_at / last_event_at / resolved_at framing the lifecycle, plus aggregated outlet_types[], dispatch_count, and failed_count. `statu params: device_id, end_time, hours, incident_id, page, per_page, search, severity, source, start_time, status |
maintenance_windows_list | Lists maintenance windows — the suppression schedules that gate alert dispatch. Use when a user asks 'why didn't this page me' or 'is this device under maintenance right now' — a quiet alert may be inside a window rather than truly silent.
Two modes:
- Global catalog (default): wraps GET /api/alerts/maintenance-windows. Returns every window with its schedule fields.
- Per-legacy-alert: pass ` params: alert_id |
tags_list | List tag definitions. The slug is the stable identifier used everywhere device-tag scoping is enforced (e.g. alert_routing_rules.tag_filters, device_list({tag: ...})). The display name is for humans.
Wraps GET /api/tags. Returns every tag the caller has visibility to (Laravel does not tag-restrict the catalog itself — operators see all tags and use the slugs that match their visible devices). Tag params: search, type |
top_bandwidth | Top NetFlow conversations over the last N minutes — the 'who's eating bandwidth right now?' question. Wraps GET /api/getTopBandwidth/{mins}, the same query that powers the dashboard live widget.
Use this for short-window 'right now' inquiries. For longer windows (hours-to-days) or filtered top-talkers, use netflow_search instead — that tool has the rich filter set; this one is the live snapshot.
params: minutes |
arp_table | Lists hosts observed on the local LAN(s) via the ARP table — the 'what devices have we seen recently?' question. Wraps POST /api/getArpTable, which collapses arptable + _dns into one row per IP with hostname + monitored-device id resolution attached.
Distinct from `arp_lookup` (single-IP MAC resolution at the current moment): this is the historical view over the last N hours. Use it for 'who's on params: hours, search |
interfaces_search | Cross-device interface metadata listing — answers 'what interfaces are tracked across the fleet, named like X, on device Y?'. Wraps GET /api/interfaces/all, which returns logging-enabled interfaces across every device the user can see (tag-scoped server-side via withUserTags).
**Metadata only.** Each row carries: id, device_id, device_label, name, interface, description. The upstream endpoint doe params: device_id, page, per_page, search |
device_metric_summary | Day / week / month / all-time summary stats for a single device-tracker, by metric type. Multi-backend: pass `metric` to pick which upstream endpoint to hit.
metric='latency' → wraps POST /api/latency/stats (icmpingId).
Returns: dayAvgLatency, weekAvgLatency, monthAvgLatency, allTimeAvgLatency (ms); dayAvgLoss, weekAvgLoss, monthAvgLoss, allTimeAvgLoss (%); dayPingCount/weekPingCount/etc.; dayU params: metric*, target_id* |
agent_disk_usage | Path-scoped folder-tree disk usage report from a Netmon agent — the 'D: drive is at 95%, what's eating it?' question. Wraps POST /api/getFolderUsageFromPath which RPCs into the agent's GETFOLDERUSAGEPATH command and returns the immediate-children size breakdown for the given path.
Required parameters: device_id (the agent-enrolled device) and path (a Windows path on that device, e.g. "D:\\" or "C params: device_id*, path* |
capture_list | Read-only listing of packet captures. Wraps GET /api/captures. Operators see their own captures; admin (sa) sees all. The upstream endpoint returns the 200 most-recent rows ordered by id desc.
Use this for 'is there a capture running on device X?' / 'do we have packet evidence for the incident?' / 'what captures finished today?' questions. Pair with capture_get to drill into one row.
Each row ca params: device_id, page, per_page, search, status |
capture_get | Read-only single-capture detail. Wraps GET /api/captures/{id}. If the capture is still active (status=starting|running) the upstream endpoint refreshes status from netmond's IPC before responding, so packets/bytes counters are live.
Returns the same row shape as capture_list rows, plus freshly-refreshed counters when applicable.
Read-only is deliberate. capture_stop / capture_delete / capture_do params: id* |
speedtest_history | Recent WAN speedtest results — answers 'is the internet healthy?'. Wraps GET /api/getSpeedTestHistory. Returns rows ordered by timestamp desc.
Each row carries the upstream's SpeedtestLog shape — typically {id, timestamp, download_mbps, upload_mbps, latency_ms, jitter_ms, server, ...}, but any new columns added on the Laravel side flow through automatically. The tool doesn't reshape the row conte params: hours, limit |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.