Skip to main content
Glama

NetOps MCP Server

A Model Context Protocol (MCP) server providing structured, bottom-up network diagnostics (OSI Layers 1–3) for LLM clients like Claude Desktop.


Key Highlights

  • WSL2 Host Boundary Traversal: WSL2 runs inside a virtualized Hyper-V switch. Standard Linux utilities cannot see host Wi-Fi or physical adapters. This server bridges across the boundary into Windows host binaries (netsh.exe, route.exe) to collect physical Wi-Fi signal, link rates, and default gateway status.

  • Complete MCP Primitive Coverage:

    • Tools: Active diagnostic probes (run_ping, get_gateway_telemetry, get_wifi_telemetry, resolve_dns, lookup_remediation, create_incident_ticket).

    • Resources: Exposes standard-backed runbooks (netops://runbooks/network-triage) directly into the agent's context window.

    • Prompts: triage_network guides the LLM through a disciplined, bottom-up diagnostic sequence rather than jumping to conclusions.

  • Defensive Engineering:

    • Strict input validation against command chaining (;, |, &, etc.) and option-injection flags (-).

    • Hard timeouts on all subprocess network calls (ping, netsh, route).

    • SQLite persistence for tracking triage incidents locally without crashing server responses on I/O failures.


Related MCP server: connectivity-diagnostics

Setup & Installation

Prerequisites

  • Python >= 3.10

  • uv (recommended) or standard python3 -m venv

1. Clone & Install Dependencies

git clone https://github.com/drew-1618/netops-mcp.git
cd netops-mcp

# Using uv (fast, deterministic sync from uv.lock)
uv sync

2. Run Directly or with MCP Inspector

Test the server in stdio mode:

uv run python -m src.server

Or test interactively using the official MCP Inspector:

npx @modelcontextprotocol/inspector uv run python -m src.server

Claude Desktop Integration (Windows + WSL)

Add the server to your Claude Desktop configuration file (%APPDATA%\Claude\claude_desktop_config.json):

{
  "mcpServers": {
    "netops": {
      "command": "wsl.exe",
      "args": [
        "-e",
        "/<your-absolute-path>/netops-mcp/.venv/bin/python",
        "-m",
        "src.server"
      ]
    }
  }
}

Note: Claude Desktop will automatically launch and manage the background WSL process over stdio. No terminal or WSL window needs to remain open.


MCP Reference

Tools

Tool

Arguments

Description

run_ping

target: str, count: int = 3

Measures reachability, packet loss %, and average RTT latency.

get_gateway_telemetry

None

Queries host routing table for default gateway and tests first-hop reachability.

get_wifi_telemetry

None

Extracts host Wi-Fi interface state, SSID, signal %, and link rates via netsh.exe.

resolve_dns

hostname: str

Resolves hostnames via local resolver and measures DNS resolution latency in ms.

lookup_remediation

category: str

Extracts specific runbook remediation sections (physical, packet_loss, latency, dns).

create_incident_ticket

target, failing_layer, summary, severity

Generates a unique incident ID (INC-XXXXXXXX) and records it in SQLite.

query_incident_history

target: Optional[str], status: Optional[str], limit: int = 5

Queries past incident records to check for recurring failures or open tickets.

Resources

URI

Description

netops://runbooks/network-triage

Full operational SLA thresholds and bottom-up triage guidelines from runbooks/network_triage_guide.md.

Prompts

Prompt

Arguments

Description

triage_network

target_host: str = "8.8.8.8"

Guides the LLM step-by-step through Layer 1 to Layer 3 diagnostic checks and incident escalation.

Available Tools

7 tools
create_incident_ticketC

Creates a structured operational incident ticket payload for escalation

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
summaryYes
severityNomedium
failing_layerYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only says 'Creates a structured operational incident ticket payload', which is ambiguous about whether it actually creates a ticket or just a payload, and doesn't mention side effects, permissions, reversibility, or any constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (one sentence), but it's under-specified. It doesn't front-load critical usage information and is too short to be adequately informative for a tool with 4 parameters and no other documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though an output schema exists, the description doesn't explain what the tool returns or how the payload is used. With no parameter details, no usage context, and no behavioral notes, the agent lacks essential information to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no information about any of the four parameters (target, summary, severity, failing_layer). The agent has no guidance on their meaning, format, or constraints, making correct invocation guesswork.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb 'Creates' and a resource 'operational incident ticket payload', which clearly differentiates it from sibling tools like query_incident_history. However, it lacks specificity about what 'payload' entails and doesn't mention the target system, so it's clear but not fully detailed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The phrase 'for escalation' hints at a use case, but it doesn't specify conditions, prerequisites, or when not to use it. No exclusions or alternative tool references are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_gateway_telemetryB

Discover the local default gateway and check first-hop reachability.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the operation (discover gateway, check first-hop reachability) but does not mention whether this is a read-only operation, whether it requires special permissions, what the output looks like, or whether it performs any active network probes that could have side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the primary action ('Discover the local default gateway') and adds the secondary purpose ('check first-hop reachability'). No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema, the description is reasonably complete for basic invocation. However, it lacks information about the return format, whether the check is active or passive, and how it relates to run_ping. An agent could call it correctly but may not know what to expect from the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema provides no parameter semantics. The description appropriately explains what the tool does without needing to document parameters. Baseline 4 is appropriate for a zero-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Discover') and resource ('local default gateway'), and adds 'check first-hop reachability' to clarify the telemetry aspect. It is clear enough to distinguish from siblings like get_wifi_telemetry, though it does not explicitly name a sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a diagnostic/network-checking use case, and the sibling list includes run_ping and resolve_dns, so an agent can infer this is for gateway-level reachability rather than general connectivity. However, it does not explicitly state when to use this tool versus run_ping or get_wifi_telemetry.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_wifi_telemetryA

Gathers local WiFi interface telemetry such as SSID, signal strength percentage, radio type, and link rates.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. The verb 'Gathers' suggests a read-only operation slash, and the listed fields indicate what data will be returned. However, it does not explicitly confirm there are no state changes, possible permission requirements, or behavior when no WiFi interface is available.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, focused sentence that front-loads the action and resource, then adds three concrete examples of the telemetry gathered. Every word earns its place; there is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only telemetry tool, the description is largely complete: it names the primary output fields, which is especially important without an output schema. The only gaps are minor edge-case disclosures, such as behavior when the WiFi interface is absent or unavailable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty (zero parameters), so there is no parameter coverage to worry about. The description compensates by listing the telemetry fields returned (SSID, signal strength, radio type, link rates), which gives the agent a clear expectation of output despite the lack of an output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Gathers' and names a clear resource: 'local WiFi interface telemetry.' It provides concrete examples (SSID, signal strength, radio type, link rates) that make the tool's purpose unambiguous and distinguish it from sibling tools like get_gateway_telemetry, which targets a different network scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the description: use it when WiFi interface telemetry is needed. However, there is no explicit 'when to use' or 'when not to use' guidance, and no mention of alternatives such as get_gateway_telemetry, leaving the agent to infer the scope from the tool name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lookup_remediationA

Look up specific remediation advice and thresholds from the triage runbook.

Valid categories: 'physical' (or 'signal', 'L1'), 'packet_loss' (or 'loss'), 'latency' (or 'RTT', 'bufferbload').

ParametersJSON Schema
NameRequiredDescriptionDefault
categoryYes

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not state whether this is a read-only lookup, what the return format is, whether it can fail for invalid categories, or any side effects. The description is purely about input validation, not behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The purpose is stated first, and the parameter guidance is compactly listed. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter lookup tool with no output schema, the description covers the input domain well but omits return value details and error behavior. An agent could call it correctly with a valid category, but would not know what to expect in the response or how to handle an invalid category.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so by enumerating valid values and aliases for the single parameter, which is genuinely useful beyond the bare schema. However, it does not explain what each category returns or how the aliases map to canonical values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('look up') and resource ('remediation advice and thresholds from the triage runbook'), which clearly distinguishes it from sibling tools like run_ping or get_gateway_telemetry. It does not explicitly name a sibling alternative, but the resource and action are specific enough to make the tool's purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit valid categories and aliases, which tells the agent exactly what input values are acceptable. It does not explicitly state when to use this tool versus alternatives, but the domain ('triage runbook') and the category list imply the intended use case clearly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_incident_historyA

Queries past incident tickets to identify recurring failures, historical context, or open issues

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
statusNo
targetNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. 'Queries' implies a read-only operation and 'past incident tickets' conveys scope, but the description does not explicitly state that no tickets are modified, nor mention permissions, rate limits, or retention. It is adequate but not rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler; it names the action, resource, and intended use cases immediately. There is no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple optional-parameter query with an output schema, the description supplies the core purpose. However, the unresolved semantics of status/target and the lack of explicit read-only confirmation leave gaps, making it a minimum-viable but not fully complete description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description never addresses the three parameters. 'limit' is inferable from its name, but 'status' and especially 'target' are ambiguous—target of an incident, a host, or a service?—and no allowed values or examples are given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the specific verb 'Queries' and resource 'past incident tickets', then states concrete goals: recurring failures, historical context, and open issues. This clearly distinguishes it from sibling tools like create_incident_ticket, which writes, and network diagnostic tools such as run_ping and resolve_dns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear use cases: identifying recurring failures, historical context, or open issues. It does not explicitly name alternatives or exclusions, but none of the sibling tools performs incident-history lookup, so the usage context is reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resolve_dnsA

Resolves a hostname using the local system resolver & measures resolution latency

ParametersJSON Schema
NameRequiredDescriptionDefault
hostnameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full transparency burden. It does disclose the mechanism ('local system resolver') and the latency measurement, which is useful. However, it does not mention failure behavior, timeouts, or whether the operation is purely read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly written sentence that front-loads the action and adds the latency detail without waste. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, has only one required parameter, and an output schema exists, so return-value details are not necessary. The description covers the core action and metric, though it could better address when to prefer this over run_ping.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needed to clarify what 'hostname' should look like (e.g., FQDN, IP address, port inclusion). It does not add any semantics beyond the schema's field title, merely echoing the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Resolves'), a specific resource ('a hostname'), and the additional behavior of measuring resolution latency. It clearly distinguishes itself from sibling tools like run_ping or telemetry queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use resolve_dns versus alternatives such as run_ping, even though the distinction between DNS resolution and network reachability is important. Usage context is only implied by the tool name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_pingB

Pings an IP address or hostname to check reachability, average latency, and packet loss.

ParametersJSON Schema
NameRequiredDescriptionDefault
countNo
targetYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral disclosure burden. It states the operation and the metrics returned, implying a read-only diagnostic, but it does not mention permissions, timeouts, packet size, or whether any state changes occur. For a simple ping this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence with no filler; the key facts (action, target type, result metrics) are front-loaded. Every phrase contributes information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient to understand what the tool does, and the stated metrics hint at the response contents despite the absence of an output schema. However, the count parameter is unspecified and no usage exclusions or operational caveats are provided, so an agent must still guess at edge cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It defines 'target' as an IP address or hostname, but it does not describe 'count', leaving the agent to infer that it controls the number of probes. This is only partial compensation for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the verb 'Pings' and specifies the resource ('an IP address or hostname') and the outcome ('reachability, average latency, and packet loss'). It is clear and distinct from sibling tools in practice, but it never explicitly contrasts with resolve_dns or the telemetry tools, so it stops short of the top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose clause 'to check reachability, average latency, and packet loss' implies when the tool is useful, but there is no explicit when-to-use or when-not-to-use guidance. Sibling tools like resolve_dns and get_gateway_telemetry exist, yet the description does not route the agent among them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedcreate_incident_ticket
    • First observedget_gateway_telemetry
    • First observedget_wifi_telemetry
    • First observedlookup_remediation
    • First observedquery_incident_history
    • First observedresolve_dns
    • First observedrun_ping

TDQS

A3.5/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinct diagnostic or operational action: gateway telemetry, WiFi telemetry, ping, DNS, runbook lookup, and incident creation/history. The only possible overlap is reachability checks between get_gateway_telemetry and run_ping, but their scopes are explicitly separated by first-hop vs arbitrary target.

Naming Consistency5/5

All tools follow a verb_noun snake_case pattern such as get_*, run_*, resolve_*, create_*, query_*, and lookup_*. There is no mix of casing or grammatical styles, and each verb clearly signals the tool's intended action.

Tool Count5/5

Seven tools is a focused, appropriately scoped set for a NetOps assistant: four network diagnostics, one remediation reference, and two incident-management tools. Each tool adds a distinct capability without unnecessary bloat.

Completeness4/5

The set covers the core diagnostic loop with gateway/WiFi/ping/DNS checks, remediation lookup, and incident creation/history. It lacks some obvious extras like traceroute or incident update/close, but these are workable gaps rather than blocking omissions.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides AI assistants with direct access to multi-vendor network devices for tasks like configuration management, health checks, and topology discovery through 35 specialized tools. It enables natural language control over platforms including Cisco, Juniper, and Nokia using SSH, NETCONF, and SNMP protocols.
    11
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to debug local networks in plain language by pinging, sweeping subnets, tracing routes, resolving DNS, scanning ports, inspecting ARP tables and active connections, and checking URL reachability.
    MIT