netdiag-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| health_checkA | Service health: version, which wrapped binaries are present on PATH, and the http_get auth prefixes. Returns a fixed shape (status/service/version + backend fields) so a monitoring caller never has to branch on missing keys. status is "healthy" when every wrapped binary is found and NETDIAG_HTTP_AUTH (if set) parses, "degraded" otherwise (the affected tools fail at call time). http_auth lists the configured URL prefixes, never the header values. |
| dns_lookupA | Resolve a DNS record via Pass resolver to query a specific nameserver instead of the host default (e.g. to check whether a change has propagated to a given resolver). transport: "plain" (UDP/TCP 53, default), "dot" (DNS-over-TLS, 853) or "doh" (DNS-over-HTTPS, 443). Requires dig from BIND 9.18+; an older dig rejects dot/doh outright instead of silently querying over plain DNS. |
| dnssec_checkA | Check whether a name validates DNSSEC against a known-validating resolver (AD bit). transport: "plain" (default), "dot" or "doh" — compare validation over plain DNS vs. an encrypted transport when port 53 may be intercepted. |
| ping_hostB | ICMP ping a host or IP. count is clamped to 1-10. |
| traceroute_pathB | Path/MTU-style hop report via |
| tcp_port_checkA | Check whether a TCP port is open (plain socket connect, no port scanning). |
| http_checkB | HEAD/GET a URL and report status, redirect chain and latency. |
| http_getA | GET a URL and return the response body (text/JSON/XML only, capped at max_bytes, hard cap 1 MiB). Use this to read a JSON endpoint or inspect an error page. For status/latency only, use http_check instead. |
| tls_cert_checkA | Fetch the TLS certificate presented on host:port and report subject/issuer/validity/SANs. |
| whois_lookupC | WHOIS lookup for a domain. |
| asn_lookupA | ASN + country-code lookup for an IP, or org info for an AS number (e.g. AS15169 or 15169). Via Team Cymru's whois service — no API key or GeoIP database needed. Takes an IP literal or AS number, not a hostname; resolve first with dns_lookup if you only have a name. |
| current_timeA | Current date, time and weekday in an IANA timezone (e.g. "Asia/Tokyo"). Call this rather than deriving the weekday from a date yourself — that is calendar arithmetic and it fails silently. Returns the date, the 24h time, the weekday in English and Japanese, the offset, UTC and the epoch, so it also serves as a clock check on this server. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
Tools target distinct network layers and functions (HTTP, TLS, DNS, WHOIS, ping, etc.). The only potential confusion is http_check vs http_get, but descriptions explicitly differentiate them by purpose (status/latency vs body retrieval) and recommend the correct one.
All tool names use snake_case, which is consistent. However, the verb-noun ordering varies: some are noun_verb (http_check, dns_lookup) while others are verb_noun (ping_host, traceroute_path). Still largely predictable and readable.
12 tools is well within the ideal 3-15 range and each tool covers a distinct diagnostic task (HTTP, TLS, DNS, DNSSEC, WHOIS, ASN, ping, traceroute, port check, plus health/clock utilities). No tool feels redundant or unnecessary.
The surface covers most core network diagnostics: HTTP, TLS certificate, DNS (all common record types), DNSSEC, WHOIS, ASN, ICMP ping, traceroute, and TCP port check. Minor gaps exist (e.g., no UDP port check, no SMTP/email diagnostic, no reverse-IP specific tool beyond PTR), but agents can work around them.