netexpert-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NETEXPERT_HTTP_PORT | No | Optional stateless HTTP transport port. Setting it (e.g. NETEXPERT_HTTP_PORT=3100 node dist/server.js) enables an HTTP endpoint: POST http://127.0.0.1:3100/mcp (JSON-RPC: tools/list, tools/call) and GET http://127.0.0.1:3100/health. | |
| NETEXPERT_MCP_CONFIG | No | Env override for the config file path. The config defaults to ~/.netexpert-mcp/config.json with sane defaults (zero-config first run). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| net.healthC | Server version, platform, capability matrix, config caps. |
| net.pingC | ICMP ping (min/avg/max/mdev), TCP-connect fallback reported honestly. |
| net.traceC | Traceroute hop list (ttl, ip, latency). |
| net.httpcheckC | GET/HEAD with timing split (dns/connect/ttfb/total), status, headers, size. LAN-safe. |
| net.portcheckC | Single TCP connect: open/closed + latency. |
| net.portscanC | Bounded TCP connect scan, default top common ports, cap 256. |
| net.sslB | TLS cert inspection: subject, SANs, issuer, expiry, daysLeft, grade. |
| net.deepscanB | Optional nmap deep scan (LAN RFC1918 targets). Requires nmap on PATH AND nmap.enabled=true in config. Opt-in by design. |
| dns.lookupC | A/AAAA/CNAME/MX/TXT/NS/SRV/PTR lookup, optional nameserver override. |
| dns.reverseC | PTR names for an IP. |
| dns.resolversC | Which DNS resolvers the OS actually uses. |
| dns.propagationC | Same record queried at trusted resolvers + DoH; diff table. |
| dns.hijackcheckC | Killer check: known-good domains via system resolver vs trusted DoH; mismatch ⇒ Finding. |
| net.publicipA | Public IPv4 (+ASN/org). Explicitly user-requested external call. |
| lan.interfacesC | Network interfaces (Nic[]): name, mac, ipv4[], ipv6[], type. |
| lan.gatewayC | Default gateway + interface + local subnet CIDR. |
| lan.arpB | ARP/neighbor cache, parsed, stale entries filtered. |
| lan.sweepB | Ping-probe an RFC1918 subnet (cap 1024 hosts) → live set. |
| lan.devicesB | Inventory: ARP ∪ RFC1918 filter, enriched with vendor (OUI) + hostname (PTR). |
| lan.hostnameC | All known names for an IP: PTR, NetBIOS (win). |
| lan.snapshotA | Save current lan.devices to a dated snapshot; or list snapshots. |
| lan.newdevicesA | Diff live devices vs latest snapshot ⇒ Finding[] (new MAC, MAC change). First run saves baseline. |
| wifi.statusA | Current WiFi link: SSID, BSSID, band, channel, RSSI, PHY rate, quality. |
| wifi.networksB | Nearby AP survey: SSID, BSSID, band, channel, security. |
| wifi.healthB | WiFi interpretation: RSSI bands, channel overlap, band mismatch ⇒ Finding[]. |
| sec.connectionsC | Active sockets with owning PID/process. |
| sec.listeningB | Listening ports per process; flags non-loopback exposures. |
| sec.firewallC | Firewall profile state per platform (win profiles / ufw / socketfilterfw). |
| sec.exposureB | Composite security report: exposed listeners × firewall state × risky ports ⇒ Finding[]. |
| sec.speedtestA | Bounded download speed test (Cloudflare default, configurable). Rate-limited 1/min. |
| lan.wolB | Wake-on-LAN magic packet (UDP broadcast). Mutating: dry-run returns confirmToken; re-call with token to execute. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 31 tools
Most tools target a distinct resource+action, and descriptions explicitly differentiate close pairs (net.portcheck single connect vs net.portscan bounded scan; lan.arp raw cache vs lan.devices enriched inventory). A few residual overlaps remain: dns.lookup already covers PTR while dns.reverse exists, dns.propagation and dns.hijackcheck both diff system resolver against trusted DoH, and sec.listening is effectively a filtered subset of sec.connections.
Every tool follows the same lowercase namespace.action convention (net.*, dns.*, lan.*, wifi.*, sec.*) with no separator or case mixing. The namespace prefix also maps cleanly to functional areas, making the set scannable.
31 tools exceeds a comfortable surface for a single agent to select from and sits above the heavy threshold, though the coverage genuinely spans five distinct diagnostic areas (net/dns/lan/wifi/sec). There is little filler and each tool has a real purpose, but the sheer count increases selection cost.
The surface covers a broad diagnostics lifecycle: reachability, DNS, LAN discovery and drift detection, WiFi health, and exposure/security reporting, with sensible opt-in gating for nmap and WOL. Minor gaps exist (no route table/IPv6-focused probing, no packet capture or bandwidth/latency soak between hosts), but agents can work around them.