Netmon — Claude Code MCP server: what it does, how to install
Connects an AI agent to a Netmon appliance so it can read devices, alerts, logs, flows, and Windows-agent data. It fits setups that need local access.
Open on GitHubWhat Netmon does
Netmon is an MCP server connection for querying a Netmon appliance from an AI coding client. The agent can inspect devices, interfaces, logs, NetFlow records, Suricata alerts, captures, and Windows-agent data. Access follows the operator account’s permissions and tag restrictions.
The client-side bridge is a local Node process. It forwards JSON-RPC traffic to the appliance’s /mcp endpoint over HTTPS. You need MCP enabled on Netmon 7.0.20 or later, an account with the API permission, and a personal token with the required mcp:* scopes. When the bridge runs outside Claude Desktop, use Node 18 or later. A self-signed appliance certificate makes a direct HTTP entry fail in Claude Code, so the bridge is the relevant setup.
What it helps with
- inspect Netmon devices and interfaces
- find Suricata alerts and syslog records
- review NetFlow data and captures
- check Windows-agent information
- identify hosts that are down
Example prompts for the agent
- Show me the Netmon devices that are currently down.
- Find Suricata alerts from last week and group them by host.
How to install Netmon
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Netmon
How do I install Netmon in Claude Code?
Add the MCP server as a local process: set command to node, put /path/to/netmon-mcpd/server/index.js in args, and define NETMON_URL=https://<your-netmon>/mcp plus NETMON_TOKEN=<your-token> in the environment. Create the token for a Netmon user with the API permission.
What does Netmon do?
It routes Claude Code requests to the Netmon MCP endpoint. The agent can read devices, logs, alerts, NetFlow, captures, and Windows-agent data within the token’s permissions.
What does Netmon need to work with Claude Code?
Use a Netmon appliance running 7.0.20 or later with MCP enabled, an account holding the API permission, and a token containing the required mcp:* scopes. The local bridge also needs Node 18 or later when it runs outside Claude Desktop.
