Netmon MCP

Connect an AI assistant to a Netmon appliance.

Netmon ships an MCP server on the appliance itself. This repository holds the client-side bridge: a small Node process that runs on your own machine, speaks stdio to Claude Desktop, and forwards every JSON-RPC message to your Netmon's /mcp endpoint over HTTPS.

Once connected, an assistant can read your devices, interfaces, logs, flow records, alerts, and Windows-agent data by calling Netmon's tools directly — with the same sign-in and permissions as any operator, and the same tag restrictions.

• Product overview and public demo: https://netmon.com/mcp-server/
• Setup guide: https://netmon.com/netmon-7-user-guide/ai-assistants/
• API reference: https://netmon.com/api-reference/authentication/

Try it first — no appliance needed

A public, read-only demo server answers the same 36 tools from a recorded, de-identified snapshot of a fictional 90-device network:

https://netmon.com/mcp-demo/mcp

No account, no token, no install. Point any MCP client at it:

claude mcp add --transport http netmon-demo https://netmon.com/mcp-demo/mcp   # Claude Code
codex mcp add netmon-demo --url https://netmon.com/mcp-demo/mcp               # OpenAI Codex
gemini mcp add --scope user --transport http netmon-demo https://netmon.com/mcp-demo/mcp
opencode mcp add netmon-demo --url https://netmon.com/mcp-demo/mcp
cline mcp install netmon-demo --transport http https://netmon.com/mcp-demo/mcp
devin mcp add -s user netmon-demo https://netmon.com/mcp-demo/mcp             # Windsurf / Devin Desktop
code --add-mcp '{"name":"netmon-demo","type":"http","url":"https://netmon.com/mcp-demo/mcp"}'
goose session --with-streamable-http-extension "https://netmon.com/mcp-demo/mcp"

GUI clients — Claude Desktop (Settings → Connectors → Add custom connector) and ChatGPT (developer mode → Connectors) — take the URL with authentication set to None. For Cursor, Zed, Kimi Code CLI, Continue and LM Studio, drop the URL into that client's MCP config file:

{
  "mcpServers": {
    "netmon-demo": { "url": "https://netmon.com/mcp-demo/mcp" }
  }
}

Then ask it something real: "what's down?", "show me the Suricata alerts from last week", "which host is using the most bandwidth, and who is it talking to?"

It is a fixture, not an appliance: nothing writes, nothing reaches a real network, and every answer is the same shape a live Netmon returns — with timestamps shifted forward so the snapshot always reads as the last day or so.

Why a local bridge

Two separate walls stand between an MCP client and an appliance on your LAN, and the bridge exists for both.

Where the connection comes from. Claude Desktop's remote-connector option and ChatGPT's custom connectors both fetch the MCP URL from their vendor's cloud, not from your machine — Anthropic's docs say so outright, and their connector resolves the hostname and rejects private addresses before any request leaves their network, so your appliance's log stays empty. Most other clients (Claude Code, Codex, Gemini CLI, Cursor, VS Code, Zed, Cline, Continue, opencode, Goose, LM Studio, Kimi) connect from your own machine and are unaffected.

The certificate. This one catches nearly everyone. Most clients validate TLS against the operating system trust store and expose no skip-verify option, and an appliance ships a self-signed certificate — so the route succeeds and the handshake fails. Either install the appliance's certificate in the machine's trust store, or use the bridge, which pins it on first use.

The bridge runs as a local process and handles both. It is not a Claude-specific workaround; it is the general answer.

If your appliance is internet-facing with a publicly-trusted certificate, you can skip the bridge and point any MCP client straight at the endpoint. See Install — any MCP client below.

Requirements

• A Netmon appliance with the MCP server enabled (Netmon 7.0.20 or newer).
• A user account with the API permission, and a personal access token carrying the mcp:* scopes you want the assistant to have.
• Claude Desktop for the .mcpb install. Claude Desktop supplies its own Node runtime, so nothing else is needed. Running the bridge outside Claude Desktop requires Node 18 or newer.

Install — Claude Desktop

1. Download netmon-mcp-<version>.mcpb from Releases. The same bundle ships with your appliance — Settings → System → Downloadables → Claude Desktop Extension.

2. In Claude Desktop, open Settings → Extensions → Advanced settings → Extension Developer → Install Extension… and select the file.

3. Fill in the two settings the extension asks for:

   Setting	Value
   Netmon URL	https://<your-netmon>/mcp — the full endpoint, including /mcp
   API Token	a personal access token (see below). The Bearer prefix is added for you if you leave it off.

4. Restart the extension. Ask Claude something like "list the devices that are down" to confirm it is working.

Minting a token

In Netmon, go to Settings → Users, click the key icon on your user, and create a personal access token. Select only the scopes the assistant needs — the token cannot be widened later, and it can be revoked from the same screen at any time.

The account must hold the API permission. Without it, token minting and OAuth consent are both refused.

Install — any MCP client

The appliance serves Streamable HTTP at https://<your-netmon>/mcp (POST for JSON-RPC, GET for the server-to-client SSE stream, DELETE to end a session).

Clients that support OAuth 2.1 discover the authorization server on their own: the endpoint answers an unauthenticated request with 401 and a WWW-Authenticate: Bearer resource_metadata="…" challenge pointing at RFC 9728 protected-resource metadata, alongside RFC 8414 authorization-server metadata and dynamic client registration at /auth/register. You sign in through your browser on your own Netmon and approve the scopes on a consent page.

Clients without OAuth support pass a token directly:

{
  "mcpServers": {
    "netmon": {
      "url": "https://netmon.example.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>"
      }
    }
  }
}

Claude Code and self-signed certificates

Most appliances serve a self-signed certificate. A direct type: http entry will fail against one — the OAuth bootstrap rejects the certificate and does not consult NODE_EXTRA_CA_CERTS. Use the bridge instead, which handles the certificate itself:

{
  "mcpServers": {
    "netmon": {
      "command": "node",
      "args": ["/path/to/netmon-mcpd/server/index.js"],
      "env": {
        "NETMON_URL": "https://netmon.example.com/mcp",
        "NETMON_TOKEN": "<your-token>"
      }
    }
  }
}

Tools

36 read tools, each wrapping a Netmon API endpoint and gated by an OAuth scope that is checked before the call runs.