# netexpert-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Omodaka9375/netexpert-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 1630  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/netexpert-mcp

## Description
Cross-platform local-network diagnostics & security-posture MCP server — the local host + LAN half; complements ugnas-mcp (the NAS half). 31 tools, bounded probes, no shells, no raw sockets.

## Tools
Capabilities this server exposes over MCP:

- **net.health** — Server version, platform, capability matrix, config caps.
- **net.ping** — ICMP ping (min/avg/max/mdev), TCP-connect fallback reported honestly.
- **net.trace** — Traceroute hop list (ttl, ip, latency).
- **net.httpcheck** — GET/HEAD with timing split (dns/connect/ttfb/total), status, headers, size. LAN-safe.
- **net.portcheck** — Single TCP connect: open/closed + latency.
- **net.portscan** — Bounded TCP connect scan, default top common ports, cap 256.
- **net.ssl** — TLS cert inspection: subject, SANs, issuer, expiry, daysLeft, grade.
- **net.deepscan** — Optional nmap deep scan (LAN RFC1918 targets). Requires nmap on PATH AND nmap.enabled=true in config. Opt-in by design.
- **dns.lookup** — A/AAAA/CNAME/MX/TXT/NS/SRV/PTR lookup, optional nameserver override.
- **dns.reverse** — PTR names for an IP.
- **dns.resolvers** — Which DNS resolvers the OS actually uses.
- **dns.propagation** — Same record queried at trusted resolvers + DoH; diff table.
- **dns.hijackcheck** — Killer check: known-good domains via system resolver vs trusted DoH; mismatch ⇒ Finding.
- **net.publicip** — Public IPv4 (+ASN/org). Explicitly user-requested external call.
- **lan.interfaces** — Network interfaces (Nic[]): name, mac, ipv4[], ipv6[], type.
- **lan.gateway** — Default gateway + interface + local subnet CIDR.
- **lan.arp** — ARP/neighbor cache, parsed, stale entries filtered.
- **lan.sweep** — Ping-probe an RFC1918 subnet (cap 1024 hosts) → live set.
- **lan.devices** — Inventory: ARP ∪ RFC1918 filter, enriched with vendor (OUI) + hostname (PTR).
- **lan.hostname** — All known names for an IP: PTR, NetBIOS (win).
- **lan.snapshot** — Save current lan.devices to a dated snapshot; or list snapshots.
- **lan.newdevices** — Diff live devices vs latest snapshot ⇒ Finding[] (new MAC, MAC change). First run saves baseline.
- **wifi.status** — Current WiFi link: SSID, BSSID, band, channel, RSSI, PHY rate, quality.
- **wifi.networks** — Nearby AP survey: SSID, BSSID, band, channel, security.
- **wifi.health** — WiFi interpretation: RSSI bands, channel overlap, band mismatch ⇒ Finding[].
- **sec.connections** — Active sockets with owning PID/process.
- **sec.listening** — Listening ports per process; flags non-loopback exposures.
- **sec.firewall** — Firewall profile state per platform (win profiles / ufw / socketfilterfw).
- **sec.exposure** — Composite security report: exposed listeners × firewall state × risky ports ⇒ Finding[].
- **sec.speedtest** — Bounded download speed test (Cloudflare default, configurable). Rate-limited 1/min.
- **lan.wol** — Wake-on-LAN magic packet (UDP broadcast). Mutating: dry-run returns confirmToken; re-call with token to execute.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "netexpert-mcp": {
    "command": "npx",
    "args": ["-y","netexpert-mcp"]
  }
}
```

## Documentation

## What netexpert-mcp does

netexpert-mcp gives MCP clients a structured way to inspect a local host, its network path, nearby devices, and selected security signals. It is intended for questions such as which devices are present, whether a service is reachable, why a connection is slow, whether DNS responses differ, and whether listening services are exposed.

The server normalizes results from Windows, Linux, and macOS into a shared JSON envelope containing success state, backend information, data, warnings, or a defined error with a hint. This lets an agent distinguish, for example, a real ICMP result from a TCP-connect fallback.

## How it works

The package runs as an MCP process over stdio, with an optional stateless HTTP transport. Tools call platform-specific facilities beneath a common service layer. Subprocesses use argument arrays and validated inputs rather than shell commands, and the server does not use raw sockets, Npcap, or Python.

Operations are constrained in code. Port scans accept at most 256 ports, LAN sweeps at most 1,024 hosts, and several operations have timeout or token-bucket limits. The optional nmap adapter is disabled unless both the binary is installed and `nmap.enabled` is set in configuration; it is restricted to RFC1918 targets.

Results can include actionable `Finding` objects. Examples include high-severity DNS mismatches, newly observed device identifiers, risky listeners, and Wi-Fi quality problems with a suggested next tool call. The server is request/response based rather than a monitoring daemon; recurring checks must be scheduled by the MCP client.

## Setup and configuration

Run it without cloning or building:

```bash
npx -y netexpert-mcp
```

It can also be installed globally with `npm install -g netexpert-mcp`, then started with `netexpert-mcp`. A stdio client configuration uses `npx` as the command and passes `-y netexpert-mcp` as arguments.

For HTTP, set `NETEXPERT_HTTP_PORT`, for example:

```bash
NETEXPERT_HTTP_PORT=3100 netexpert-mcp
```

The MCP endpoint is `/mcp` on localhost, and `/health` provides a liveness check. Optional settings are stored at `~/.netexpert-mcp/config.json`. They cover default ping and traceroute values, trusted DNS resolvers and DoH, scan ceilings, rate limits, and nmap enablement. Environment overrides include `NETEXPERT_MCP_CONFIG`, `NETEXPERT_HTTP_PORT`, and `NETEXPERT_WIFI_IF` for a Linux wireless interface. Configuration keys containing password, token, secret, or credential are rejected.

## Tools and capabilities

- Test reachability with ICMP or an explicitly identified TCP fallback, trace routes, inspect HTTP timing, check one port, scan bounded port lists, and inspect TLS certificates.
- Look up common DNS record types, identify the operating system's active resolvers, compare propagation across resolvers and DoH, and detect suspicious differences for known-good domains.
- Inspect interfaces, gateways, filtered ARP neighbors, RFC1918 hosts, device vendors from the bundled IEEE OUI database, and PTR or Windows NetBIOS names.
- Save inventory snapshots, compare the live network with a baseline, and identify new MAC addresses or changed MAC-to-IP associations.
- Report Wi-Fi link details and nearby access points, then interpret signal strength, channel overlap, band mismatch, and PHY rate.
- Review active connections, process-owned listeners, platform firewall state, and exposure involving ports such as 445, 3389, 23, 135–139, 5357, and 5900.
- Plan and confirm one Wake-on-LAN broadcast. The tool uses a single-use confirmation token with a ten-minute lifetime; it is the only mutating operation.
- Retrieve public IPv4 and ASN or organization information, and optionally run a bounded Cloudflare download test.

## Limitations and notes

The server has no credentials or telemetry configuration. Internet-facing behavior occurs only when explicitly invoking tools such as public-IP lookup, speed testing, or DNS-over-HTTPS checks. Platform capabilities vary; `net.health` reports available backends and installation hints.

The LAN inventory combines ARP and RFC1918 discovery, so visibility depends on the local network and operating-system facilities. Deep scans require a separate nmap installation and explicit opt-in. First use of `lan.newdevices` creates a baseline automatically, while later calls compare the live inventory against it.

_Full upstream README: https://allmcps.com/mcp/netexpert-mcp/readme_