# netdiag MCP [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/shigechika/netdiag-mcp  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/netdiag-mcp

## Description
MCP server wrapping dig, ping, mtr, whois and TLS/HTTP checks for on-demand network diagnostics

## Tools
Capabilities this server exposes over MCP:

- **dns_lookup** — Resolve a DNS record via `dig` (A/AAAA/MX/TXT/NS/CNAME/SOA/PTR/CAA), optionally against a specific resolver and over plain DNS/DoT/DoH
- **dnssec_check** — Query a known-validating resolver and report whether the AD bit is set (plain/DoT/DoH) — the only reliable way to confirm DNSSEC validation, since an RRSIG being present in a plain `dig` reply does not by itself prove anything validated it
- **ping_host** — ICMP ping (count clamped to 1-10)
- **traceroute_path** — Hop-by-hop path/loss report via `mtr --report` (fixed cycles, not a live/continuous run)
- **tcp_port_check** — Is a TCP port open — a plain socket connect, not a port scan
- **http_check** — HEAD/GET a URL and report status, redirect chain, and latency
- **http_get** — GET a URL and return the body. Textual types only (`text/*`, JSON, XML, JavaScript, YAML, `+json`/`+xml`), capped at 1 MiB. Refuses loopback, link-local and cloud-metadata destinations, including via redirect
- **tls_cert_check** — Fetch the certificate a host presents and report subject/issuer/validity/SANs
- **whois_lookup** — WHOIS lookup for a domain
- **asn_lookup** — ASN + country-code lookup for an IP, or org info for an AS number, via Team Cymru's whois service — no API key or GeoIP database needed
- **current_time** — Current date, time and weekday in an IANA timezone — the weekday is returned as data because deriving it from a date is arithmetic that fails silently. Also reports UTC and epoch, so it doubles as a clock check
- **health_check** — Version and which wrapped binaries (`dig`/`ping`/`mtr`/`whois`) are present on PATH

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "netdiag-mcp": {
    "command": "uvx",
    "args": ["netdiag-mcp"]
  }
}
```

## Documentation

## What netdiag MCP MCP server does

The netdiag MCP MCP server provides a collection of single-target, read-only checks for common network troubleshooting tasks. DNS tools can query A, AAAA, MX, TXT, NS, CNAME, SOA, PTR, and CAA records, use a selected resolver, and send queries over plain DNS, DNS-over-TLS, or DNS-over-HTTPS. A separate DNSSEC check examines the AD bit returned by a known-validating resolver.

Reachability tools cover ICMP ping, an `mtr --report` hop and packet-loss summary, and a TCP connection test for one host and port. HTTP tools report status, redirects, and latency, or retrieve a textual response body. TLS inspection returns the presented certificate's subject, issuer, validity period, and SANs. WHOIS, ASN, timezone, and service health checks round out the diagnostic set.

## How it works

The server delegates DNS, ping, path, and domain WHOIS operations to `dig`, `ping`, `mtr`, and `whois` found on the process PATH. TCP, HTTP, and TLS checks use Python's socket, SSL, and HTTP client functionality instead of external `nc`, `curl`, or `openssl` commands. ASN lookups use Team Cymru's WHOIS service and do not require an API key or a GeoIP database.

DNS-over-TLS and DNS-over-HTTPS require BIND `dig` version 9.18 or newer. An older binary rejects those transport options rather than silently performing an unencrypted query. `health_check` reports the server version and whether the wrapped command-line programs are available.

## Setup and configuration

Install the package with `pip install netdiag-mcp` or `uv tool install netdiag-mcp`. On Debian or Ubuntu, the optional command-line dependencies can be installed with `dnsutils`, `iputils-ping`, `mtr-tiny`, and `whois`. The Python-based TCP, HTTP, and TLS tools can still operate when those binaries are absent.

The netdiag MCP MCP server requires no environment variables or application configuration. Claude Code can install it through the repository's plugin marketplace, or add it manually with `claude mcp add netdiag -- netdiag-mcp`. The executable must be available to the process launching the MCP client. `mtr` may need raw-socket capability; Debian and Ubuntu's `mtr-tiny` package normally configures this for its helper.

## Tools and capabilities

- `dns_lookup` and `dnssec_check` inspect records and DNSSEC validation status.
- `ping_host`, `traceroute_path`, and `tcp_port_check` test reachability and one port.
- `http_check` follows and reports redirects; `http_get` returns textual bodies up to 1 MiB.
- `tls_cert_check` examines the certificate presented by a host.
- `whois_lookup`, `asn_lookup`, `current_time`, and `health_check` provide supporting context.

The netdiag MCP MCP server rejects loopback, link-local, and cloud-metadata destinations for HTTP retrieval, including redirects. Inputs are validated and range-limited, and external commands receive argument lists rather than shell strings.

## Limitations and notes

There is no batch, sweep, or `nmap`-style multi-host or multi-port scanning. Ping counts are limited to 1–10, and the path report uses fixed `mtr` cycles rather than a continuous session. TLS or HTTP checks against a bare IP can fail on SNI-dependent or CDN-fronted services; use the hostname in those cases. `http_get` supports textual content types only and limits responses to 1 MiB.

_Full upstream README: https://allmcps.com/mcp/netdiag-mcp/readme_