Skip to main content
Glama

Netmon (demo)

arp_table

Read-onlyIdempotent

Lists hosts observed on the local LAN(s) via the ARP table — the 'what devices have we seen recently?' question. Wraps POST /api/getArpTable, which collapses arptable + _dns into one row per IP with hostname + monitored-device id resolution attached.

Distinct from arp_lookup (single-IP MAC resolution at the current moment): this is the historical view over the last N hours. Use it for 'who's on the LAN today' / 'is there a new device' / 'where did this IP last appear' questions.

Each row: {id, ip, mac, timestamp, hostname, device_id}. device_id is non-null when the IP corresponds to a monitored Netmon device; hostname comes from _dns (PTR + custom overrides). Rows are deduped by IP — only the latest seen entry per IP within the window is returned.

Permission: devices. Tag-scoping is NOT applied here — ARP is subnet-level, not device-level, so it doesn't have a tag anchor. Operators see the whole LAN regardless of tag scope.

Examples: arp_table({}) // last 24h, no filter arp_table({hours: 1, search: "10.0.0"}) arp_table({search: "laptop"})

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hoursNoLookback hours (1-168). Default 24.
searchNoSubstring (server-side ILIKE) on ip / mac / hostname. Empty matches all.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses behavioral details not visible in structured data: the tool wraps POST /api/getArpTable, returns a collapsed view of arptable + _dns, deduplicates by IP keeping the latest entry, and has a security-relevant quirk — it ignores subnet-level/tag-level scoping and shows the whole LAN. It also documents permission requirements and scope implications. Beyond this, the annotations already mark it readOnly/idempotent/destructive=False, so the description's disclosure of the collapse, dedup, and tag-scoping behavior goes well beyond what annotations provide. Anthropic's 'beyond annotations' bar is satisfied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with a clear lead sentence, explicit differentiation, a structured row definition, and examples. Everything earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers endpoint wrapper, filtering semantics, output shape, permission implications, and usage patterns. With annotations carrying the read-only profilehb, nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of params. The description adds usage color: hours defaults to 24, search is substring ILIKE across ip/mac/hostname, and the examples show real combinations. Description enriches the schema without repeating it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Lists hosts observed on the local LAN(s) via ARP table') and scopes it with 'what devices have we seen recently?' It also introduces the resource (ARP table) and distinguishes it from the sibling `arp_lookup` by contrasting historical vs. current single-IP resolution. The row structure is explicitly listed, and the example usage further anchors the purpose. No ambiguity remains about which tool is which.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly differentiates from sibling `arp_lookup` by naming it and contrasting single-IP MAC resolution with the historical multi-host view. Provides concrete example calls with different filters, making it clear when and how to use the tool. This is a model example of usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.