mcp-registry/com.netmon/netmon-demo · v1.0.0
Also listed as glama/netmon-services/netmon-mcpd, mcp-registry/com.netmon/netmon
As of 2026-10-17 11:14 UTC, the Netmon Demo MCP server is up with a Glimind reliability score of 80/100 (grade B). Over the last 30 days it answered 99.7% of Glimind's liveness checks. It had 10 outages in 90 days, with a median recovery of 13 minutes.
Public read-only demo of Netmon's network monitoring tools over a recorded snapshot.
Claude Code
claude mcp add --transport http netmon-demo-mcp-server https://netmon.com/mcp-demo/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"netmon-demo-mcp-server": {
"type": "http",
"url": "https://netmon.com/mcp-demo/mcp"
}
}
}
Third-party server, listed as discovered. Review its source before installing.
5 tool(s) have parameters with no type (no type/enum/anyOf/$ref).
Give every parameter a "type" (or "enum"/"anyOf"). Untyped parameters make models guess — strings for numbers, objects for arrays.
5 parameter(s) across 2 tool(s) have no description.
Add a "description" to each parameter with its format and an example ("ISO 8601 date, e.g. 2026-10-17"). This is the commonest cause of wrong arguments on the first call.
Handshake + tools/list takes ~1,742 ms.
Serve tools/list from memory, keep the process warm, and host close to your users. Every new agent session pays this before its first call.
No tool declares an outputSchema.
Declare outputSchema and return structuredContent (MCP 2025-06-18+). Agents can then parse results without guessing, and chain tools reliably.
Paste-ready definitions with the problems above fixed. Changes marked verify need a human look. 2 tool(s) still need parameter descriptions written by someone who knows the API. All of them as JSON: /v1/readiness/mcp-registry%2Fcom.netmon%2Fnetmon-demo/fixes
{
"name": "alerts_history",
"description": "Authoritative 'what fired and when' stream — wraps the `alert_history` table (one row per incident, both legacy and modern) and `alert_outlet_log` (per-dispatch ledger keyed by history_id).\n\nDefault mode: lists incidents newest-first. Each row is one incident with opened_at / last_event_at / resolved_at framing the lifecycle, plus aggregated outlet_types[], dispatch_count, and failed_count. `status` is computed from resolved_at: 'open' if null, 'resolved' otherwise.\n\nDrill-down mode: pass `incid",
"inputSchema": {
"type": "object",
"properties": {
"page": {
"type": "integer",
"minimum": 1,
"description": "1-indexed page number (default 1)."
},
"hours": {
"type": "integer",
"maximum": 168,
"minimum": 1,
"description": "Lookback window applied against last_event_at (default 24)."
},
"search": {
"type": "string",
"description": "Case-insensitive substring on alert_label / subject."
},
"source": {
"enum": [
"legacy",
"modern",
"all"
],
"type": "string",
"description": "Filter by source axis. Default 'all'."
},
"status": {
"enum": [
"open",
"resolved",
"all"
],
"type": "string",
"description": "Filter by lifecycle state. Default 'all'."
},
"end_time": {
"type": "string",
"description": "ISO-8601 UTC; pairs with start_time."
},
"per_page": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Rows per page (default 50, max 200)."
},
"severity": {
"description": "Severity int or array of ints (1-5, lower=worse).",
"type": "string"
},
"device_id": {
"type": "integer",
"description": "Restrict to one device id."
},
"start_time": {
"type": "string",
"description": "ISO-8601 UTC; pairs with end_time."
},
"incident_id": {
"type": "integer",
"description": "If set, switches to per-incident dispatch-ledger mode (returns alert_outlet_log rows). This is alert_history.id, NOT alert_id."
}
}
},
"annotations": {
"title": "Alert Incident History",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}{
"name": "alerts_list",
"description": "List configured alert definitions across both axes of the rule engine. Modern alerts (table `alerts`, class-scoped: syslog_log / event_log / eve_log / device_down / storage) and legacy alerts (per-device tracker thresholds, surfaced via the `_hell` view) are fetched, normalized, merged, filtered, and paginated.\n\nWraps GET /api/alerts (modern) and POST /api/getAlerts (legacy). Both endpoints return their full catalog; this tool applies the filters and pagination client-side, so the LLM doesn't ne",
"inputSchema": {
"type": "object",
"properties": {
"page": {
"type": "integer",
"minimum": 1,
"description": "1-indexed page number (default 1)."
},
"class": {
"enum": [
"syslog_log",
"event_log",
"eve_log",
"device_down",
"storage"
],
"type": "string",
"description": "Modern-only filter on the alert class (silently ignored on legacy rows)."
},
"scope": {
"enum": [
"modern",
"legacy",
"all"
],
"type": "string",
"description": "Which axis to query: 'modern' (alerts table), 'legacy' (_hell view), or 'all' (default)."
},
"search": {
"type": "string",
"description": "Case-insensitive substring match on label."
},
"enabled": {
"type": "boolean",
"description": "Restrict to enabled (true) or disabled (false) alerts."
},
"per_page": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Rows per page (default 50, max 200)."
},
"severity": {
"description": "Severity int or array of ints. Modern uses 1-5 (lower=worse). Legacy varies by tracker type; passing an int filters both axes.",
"type": "string"
},
"device_id": {
"type": "integer",
"description": "Legacy-only: restrict to a single device id. Ignored on modern rows."
}
}
},
"annotations": {
"title": "List Alert Definitions",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}{
"name": "eve_search",
"description": "Search Suricata EVE-format IDS events. Wraps GET /api/eve/list (permission: logs); tag-scoped server-side.\n\nSeverity is Suricata-native: 1=high, 2=medium, 3=low/info — a 3-point scale, NOT syslog's 0-7. Takes names or ints: 'high'=1, 'medium'=2, 'low'/'info'/'informational'=3. Single value or an array, which may mix the two forms (e.g. [\"high\", 2]).\n\nIP filters: passing only src_ip or only dst_ip matches either side (OR); pass both to AND them together. `device_id` is a convenience — the control",
"inputSchema": {
"type": "object",
"properties": {
"vlan": {
"type": "integer"
},
"hours": {
"type": "integer",
"maximum": 168,
"minimum": 1,
"description": "Lookback hours (1-168). Default 24."
},
"iface": {
"type": "string",
"description": "Capture interface."
},
"limit": {
"type": "integer",
"maximum": 500,
"minimum": 1
},
"proto": {
"type": "string",
"description": "Protocol name (e.g. 'TCP', 'UDP')."
},
"dst_ip": {
"type": "string",
"description": "Destination IP. Matches either side when src_ip is absent."
},
"src_ip": {
"type": "string",
"description": "Source IP. Matches either side when dst_ip is absent."
},
"dst_port": {
"type": "integer"
},
"end_time": {
"type": "string",
"description": "ISO-8601 UTC; must pair with start_time."
},
"severity": {
"description": "Severity name(s) or int(s) on Suricata's 3-point scale: 'high'=1, 'medium'=2, 'low'/'info'/'informational'=3. Single value or array; names and ints may be mixed.",
"type": "string"
},
"src_port": {
"type": "integer"
},
"device_id": {
"type": "integer",
"description": "Restrict to a single device id (translated to src_ip/dst_ip server-side)."
},
"start_time": {
"type": "string",
"description": "ISO-8601 UTC; must pair with end_time."
},
"signature_id": {
"description": "Suricata signature id(s). Single int or array.",
"type": "string"
}
}
},
"annotations": {
"title": "Search Suricata IDS Events",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}Get an email or webhook when this server's readiness drops by 10+ points, tool-poisoning text appears, or a tool breaks:
curl -X POST https://glimind.com/v1/subscriptions -H 'content-type: application/json' -d '{"tools":["mcp-registry/com.netmon/netmon-demo"],"email":"[email protected]"}'Agents: watch_tool({"toolId": "mcp-registry/com.netmon/netmon-demo"}) over MCP.
netflow_search ~669 tokensnetflow_raw_search ~660 tokensdevice_list ~563 tokensdevice_get ~535 tokenssyslog_facets ~507 tokensStatic checks of the advertised tools/list (schema, descriptions, annotations, tool-poisoning patterns, names, size) plus observed protocol, uptime, latency and contract changes. Read-only: no tool is ever called. Weights: schema 15, docs 20, safety 15, efficiency 15, compatibility 15, protocol 5, reliability 10, stability 5. Token counts are estimates (~3.6 characters per token).
Operator? Fix these, then re-check live. Embed the readiness badge:
[](https://glimind.com/server/mcp-registry%2Fcom.netmon%2Fnetmon-demo?ref=badge)
<a href="https://glimind.com/server/mcp-registry%2Fcom.netmon%2Fnetmon-demo?ref=badge"><img src="https://glimind.com/v1/readiness/badge/mcp-registry%2Fcom.netmon%2Fnetmon-demo.svg" alt="MCP agent-readiness"></a>
.. image:: https://glimind.com/v1/readiness/badge/mcp-registry%2Fcom.netmon%2Fnetmon-demo.svg :target: https://glimind.com/server/mcp-registry%2Fcom.netmon%2Fnetmon-demo?ref=badge :alt: MCP agent-readiness
Glimind records every version of this server's tool definitions in a signed, append-only transparency log. Current manifest sha256:8b6377e0864db776…, first seen 2026-10-17, included at leaf 6238 of 17,474. Version history · verify what your client received.
Compare: most reliable data servers · most reliable devops servers · most reliable network servers · most reliable security servers · most reliable search servers
Glimind tells agents whether a server is up right now and how to call it, then fails over to a live alternative when it isn't.
Claude Code
claude mcp add --transport http glimind https://glimind.com/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"glimind": {
"type": "http",
"url": "https://glimind.com/mcp"
}
}
}
As of 2026-10-17 11:14 UTC, the Netmon Demo MCP server is up with a Glimind reliability score of 80/100 (grade B). Over the last 30 days it answered 99.7% of Glimind's liveness checks. It had 10 outages in 90 days, with a median recovery of 13 minutes.
Netmon Demo MCP server advertises 36 tools, including agent_disk_usage, agent_processes, agent_services, alerts_history, alerts_list.
Point your MCP client at this streamable-http endpoint: https://netmon.com/mcp-demo/mcp
Glimind scanned all 36 tool definitions for tool-poisoning patterns — hidden or invisible characters, instructions that override the model, concealment from the user, requests to read credential or MCP config files, conversation exfiltration and cross-tool shadowing — and found none. This checks what the server tells the model, not what its code does; review the source before granting access to sensitive data.
Status page: 90-day uptime, every outage and how long it lasted.
Claim this listing to get the Verified operator marker, a remediation checklist and owner analytics, or embed the live badge from any of the tool pages above. Maintainers: alerts, deploy attestation and monthly reports.
Status is an automated estimate from Glimind's liveness checks (handshake and tool listing only; no tool is ever called) and may lag or differ from your network. Glimind is not affiliated with this server or its operator. Operator? Request a correction or opt out at https://glimind.com/opt-out.