Security & Testing

netmon.com

Provides network diagnostic and reconnaissance tools including WHOIS/GeoIP/DNS lookup, ARP lookup, ping, traceroute, and Nmap port scanning.

1 endpoint36 known toolsFirst detected August 19, 2026Last detected August 19, 2026

ENDPOINT 1

https://netmon.com/mcp-demo/mcp

No auth detected

MCP server metadata

Name: netmon7-demo
Version: 1.0.0

Capabilities

toolspromptsresourceslogging

Server instructions

This is the public Netmon demo server. It answers with a recorded snapshot of a fictional 90-device network across three sites, not a live appliance, so results are stable and no argument can reach real infrastructure. Tools that would probe the network on a real appliance (ping, traceroute, port_map, snmp_walk_run) replay a recorded probe of the demo fleet. Device ids worth starting from: 273 (Brain, the firewall), 272 (Pinky, a Windows agent host), 8 (Yakko, a switch), 10 (Dot, a NAS), 17 (Wakko, a hypervisor). Try overwatch_summary first, then device_get, syslog_search or eve_search. A real appliance serves these same tools over OAuth 2.1 at https://<appliance>/mcp. See https://netmon.com/mcp-server/.

Known tools 36

get_network_entity_info

Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname.

Inferred read-only

arp_lookup

Performs an ARP lookup to find the MAC address for a given Local IP address.

Inferred read-only

ping

Ping a target host from the Netmon server.

Inferred read-only

traceroute

Traceroute to a target from the Netmon server.

Inferred read-only

port_map

Nmap port scan against a single host from the Netmon server.

Inferred read-only

search_ip

Find every mention of a specific IP across Netmon's log and telemetry streams: syslog, Windows eventlog, Suricata EVE, aggregated NetFlow, and ARP.

Inferred read-only

syslog_search

Search syslog messages from network devices.

Inferred read-only

eventlog_search

Search Windows Event Log entries ingested from Netmon agents.

Inferred read-only

eve_search

Search Suricata EVE-format IDS events.

Inferred read-only

eve_get

Fetch a single Suricata EVE event by id, decoded server-side.

Inferred read-only

log_severity_summary

Count log events grouped by severity over a time window.

Inferred read-only

syslog_facets

Top-N value counts for ONE syslog field over a window — 'what are the top actions/reasons on this FortiGate in the last 2 hours' in a single call, instead of pulling rows and counting them yourself.

Inferred read-only

netflow_search

Search the FULL NetFlow history: the raw flow table (the last ~15 minutes) unioned with the aggregated rollup (4 weeks of history), windowed and pro-rated server-side.

Inferred read-only

netflow_raw_search

Search raw NetFlow records (per-flow, not aggregated).

Inferred read-only

flow_summary

Summarize one host's network conversations: top peers, top ports, and a client-vs-service-side split, each with a residual "other" bucket plus overall totals.

Inferred read-only

device_list

List monitored devices.

Inferred read-only

device_get

Fetch one device with its related state: tags, alerts, the ping / oid / interface / port / disk trackers configured on it, its SNMP walk trackers, and a netflow rollup.

Inferred read-only

device_find

Find devices matching a substring of label or ip_address.

Inferred read-only

overwatch_summary

High-level network health snapshot for 'how's the network?

Inferred read-only

snmp_test

Probe a device for SNMP reachability using the Netmon snmptest binary.

Inferred read-only

snmp_walk_last

Fetch the most recent stored SNMP walk for a device (cached in tools_walks).

Inferred read-only

snmp_walk_run

Trigger a FRESH SNMP walk against a device.

Inferred read-only

agent_services

List Windows services on an agent-managed device — live read via the WMI tunnel.

Inferred read-only

agent_processes

List running processes on an agent-managed device — live read via the agent tunnel.

Inferred read-only

alerts_list

List configured alert definitions across both axes of the rule engine.

Inferred read-only

alerts_history

Authoritative 'what fired and when' stream — wraps the `alert_history` table (one row per incident, both legacy and modern) and `alert_outlet_log` (per-dispatch ledger keyed by history_id).

Inferred read-only

maintenance_windows_list

Lists maintenance windows — the suppression schedules that gate alert dispatch.

Inferred read-only

tags_list

List tag definitions.

Inferred read-only

top_bandwidth

Top NetFlow conversations over the last N minutes — the 'who's eating bandwidth right now?

Inferred read-only

arp_table

Lists hosts observed on the local LAN(s) via the ARP table — the 'what devices have we seen recently?

Inferred read-only

interfaces_search

Cross-device interface metadata listing — answers 'what interfaces are tracked across the fleet, named like X, on device Y?

Inferred read-only

device_metric_summary

Day / week / month / all-time summary stats for a single device-tracker, by metric type.

Inferred read-only

agent_disk_usage

Path-scoped folder-tree disk usage report from a Netmon agent — the 'D: drive is at 95%, what's eating it?

Inferred read-only

capture_list

Read-only listing of packet captures.

Inferred read-only

capture_get

Read-only single-capture detail.

Inferred read-only

speedtest_history

Recent WAN speedtest results — answers 'is the internet healthy?

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.netmon7-demo]
url = "https://netmon.com/mcp-demo/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "netmon7-demo": {
      "type": "http",
      "url": "https://netmon.com/mcp-demo/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: netmon7-demo
Remote MCP URL: https://netmon.com/mcp-demo/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "netmon7-demo": {
      "url": "https://netmon.com/mcp-demo/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "netmon7-demo": {
      "type": "http",
      "url": "https://netmon.com/mcp-demo/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "netmon7-demo",
  "transport": "streamable-http",
  "url": "https://netmon.com/mcp-demo/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.