// SCAN REPORT

Mcp Nettools

235 tools. 11 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated:

11 can modify or destroy data
224 read-only
235 tools total

Community server · catalogue entry checked 03/07/2026

How to control Mcp Nettools ↓

TOOL MAP

What Mcp Nettools exposes to your agents

Read (224) Write / Execute (10) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Mcp Nettools tools

Destructive · High http_delete HTTP DELETE requests are used to remove resources on remote servers. Execute · Low speedtest The speedtest tool executes an external operation (network speed test) rather than simply retrieving static data. Execute · High http_post HTTP POST requests are not read-only; they submit data to external servers and can create resources, trigger actions, or cause side effects. Execute · Medium wake_on_lan This tool triggers an external operation (sending a network packet) that causes a remote machine to power on.

11 of Mcp Nettools's 235 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Mcp Nettools

PolicyLayer is an MCP gateway — it sits between your AI agents and Mcp Nettools, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "http_delete": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "http_patch": {
    "limits": [
      {
        "counter": "http_patch_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "arp_table": {
    "limits": [
      {
        "counter": "arp_table_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Mcp Nettools — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON MCP NETTOOLS →

Instant setup, no code required.

FULL CATALOGUE

All 235 Mcp Nettools tools

DESTRUCTIVE 1 tools
Destructive http_delete Send an HTTP DELETE request. Some REST APIs require a body with DELETE (e.g. bulk delete). body: optional requ
EXECUTE 8 tools
Execute check_mqtt Connect to an MQTT broker and send a CONNECT packet (v3.1.1). Checks for a CONNACK response and decodes the re Execute check_rdp check_rdp Execute http_post http_post Execute ping Ping a host and return reachability, packet loss %, and RTT stats. count: 1-30. timeout: 1-60 s per packet. Execute port_scan Check multiple TCP ports on a host. ports: comma-separated or ranges (e.g., '22,80,443,8000-8080'). Max 500 po Execute speedtest Run a network speed test using the nearest server. Execute traceroute Trace the network path to a host. max_hops: 1-64. timeout: overall timeout in seconds. wait: per-hop probe wai Execute wake_on_lan Send a Wake-on-LAN magic packet to a MAC address.
WRITE 2 tools
Write http_patch http_patch Write http_put http_put
READ 224 tools
Read arp_table Show ARP/neighbor table entries (IP-to-MAC mappings) as structured records. interface: optional filter by netw Read bgp_lookup Look up BGP/ASN information for a public IP address using Team Cymru's WHOIS service. Returns the ASN, BGP pre Read cert_check Check the SSL certificate on a host — expiry, issued date, issuer, SANs, and days remaining. timeout: 1-60 s. Read cert_check_bulk Check TLS certificates for multiple hosts in one call. hosts: comma-separated hostnames (max 20). Returns expi Read check_actual_budget Check Actual Budget personal finance server health via GET /health. Returns healthy state. Read check_adguard Check AdGuard Home DNS filter health via GET /control/status. Returns running state and version. username/pass Read check_alertmanager Check Prometheus Alertmanager health via GET /-/healthy and /-/ready. Returns health/readiness status and vers Read check_anythingllm Check AnythingLLM (self-hosted RAG/AI workspace) health via GET /api/ping. Returns healthy status. Default por Read check_appwrite Check Appwrite open-source BaaS health via GET /v1/health. Returns HTTP status. Default port 80 (HTTPS on 443) Read check_archivebox Check ArchiveBox web archiving service reachability via GET /. Returns 200 or 302 when service is up. Default Read check_audiobookshelf Check Audiobookshelf audiobook and podcast server health via GET /api/health. Returns server version. Default Read check_authelia Check Authelia authentication server health via GET /api/health. Returns healthy when service is up. Default p Read check_authentik Check Authentik identity provider health via GET /-/health/live/ and /-/health/ready/. Returns live and ready Read check_baikal Check Baïkal CalDAV/CardDAV server reachability via GET /. Returns 200 or 302 when service is up. Default port Read check_bazarr Check Bazarr subtitle management server health via GET /api/system/status. Returns version string. 401 = runni Read check_beszel Check Beszel server monitoring hub reachability via GET /api/health. Default port 8090. Read check_bitwarden Check Bitwarden (Unified) server health via GET /api/alive. A 200 response confirms the server is operational. Read check_bookstack Check BookStack wiki platform health via GET /status. Returns health status. Read check_calibre_web Check Calibre-Web ebook library server health via GET /. 200 or redirect to /login = healthy. Default port 808 Read check_cassandra Check Apache Cassandra availability using the CQL binary protocol. Sends a CQL OPTIONS request and verifies a Read check_changedetection Check changedetection.io web change monitoring server health via GET /api/v1/systeminfo. Returns version. Defa Read check_checkmk Check Checkmk (IT monitoring) reachability via GET /. Default port 5000. Read check_clickhouse Check ClickHouse OLAP database availability via HTTP /ping endpoint. Returns 'Ok.' on success. Port 8123 = HTT Read check_cockpit Check Cockpit Linux server management web UI health. Tries GET /cockpit/login — 200, 302, or 401 = healthy. De Read check_code_server Check code-server (VSCode in browser) health via GET /healthz. Returns 'OK'. Default port 8080. Read check_collabora Check Collabora Online Office server health via GET /api/v1/config. 200 or 400 = server running. Default port Read check_consul Check Consul agent health and cluster leader. Returns agent node name, datacenter, server/client role, leader Read check_couchdb Check Apache CouchDB availability via GET / which returns version and node name. Port 5984 = HTTP, 6984 = HTTP Read check_crowdsec Check CrowdSec security agent local API reachability via GET /metrics. Default port 6060 (Prometheus metrics e Read check_dashdot Check Dashdot server stats dashboard health via GET /health. Returns healthy status and server info if availab Read check_directus Check Directus headless CMS health via GET /server/health. Returns status 'ok' and service checks. Default por Read check_discourse Check Discourse forum health via GET /srv/status (returns JSON status) or /about.json for version info. Defaul Read check_dkim Check whether a DKIM public key is published for a domain and selector. Looks up the TXT record at selector._d Read check_dmarc check_dmarc Read check_docker_api Check Docker daemon REST API availability via GET /_ping. Port 2375 = unencrypted, 2376 = TLS. Returns daemon Read check_docmost Check Docmost collaborative wiki/documentation health via GET /api/health. Returns healthy/reachable status. D Read check_docuseal Check DocuSeal document signing service reachability via GET /. Returns 200 or 302 when service is up. Default Read check_dokuwiki Check DokuWiki health via GET /doku.php. A 200 or redirect response confirms the wiki is running. Default port Read check_dozzle Check Dozzle Docker log viewer health via GET /healthcheck. Returns healthy/reachable status. Default port 808 Read check_elasticsearch Connect to an Elasticsearch or OpenSearch node and check cluster health. Returns cluster name, status (green/y Read check_emby Check Emby Media Server reachability via GET /System/Info/Public. Returns server name and version when healthy Read check_etcd Check etcd v3 cluster health via its HTTP health endpoint. Returns health status and reason if unhealthy. host Read check_filebrowser Check File Browser web-based file manager health via GET /api/health. Default port 80. Read check_firefly_iii Check Firefly III personal finance manager health via GET /api/v1/about (returns 200 with version or 401 if un Read check_flame Check Flame startpage/dashboard reachability via GET /. Default port 5005. Read check_flaresolverr Check FlareSolverr Cloudflare bypass proxy health via GET /v1. Returns version and number of active sessions. Read check_forgejo Check Forgejo (Gitea fork) git server health via GET /api/healthz. Returns status. Read check_freshrss Check FreshRSS feed aggregator availability. FreshRSS has no dedicated health endpoint; checks if the main pag Read check_frigate Check Frigate NVR (network video recorder) health via GET /api/stats. Returns camera count, detection FPS, pro Read check_gatus Check Gatus health monitoring dashboard reachability via GET /health. Returns healthy=true when all configured Read check_ghost Check Ghost blog platform health via GET /ghost/api/admin/site/. Returns version and site title. Default port Read check_gitea Check Gitea/Forgejo git server health via GET /api/healthz. Returns status and availability. Read check_gitlab Check GitLab instance health via GET /-/health. Confirms the application is running and can accept requests. D Read check_gitness Check Gitness (Harness git hosting) health via GET /api/v1/health. Returns 200 when service is up. Default por Read check_glances Check Glances system monitoring server health via GET /api/3/status. Returns version. Default port 61208. Read check_gotify Check Gotify push notification server health via GET /health. Returns healthy state and version. Read check_grafana Check Grafana observability platform health via GET /api/health. Returns version, commit hash, database status Read check_grist Check Grist spreadsheet/database service health via GET /api/docs. Returns 200 or 401 when service is up. Defa Read check_grocy Check Grocy grocery and household management server via GET /api/system/info. Returns version and PHP info. Read check_guacamole Check Apache Guacamole clientless remote desktop gateway via GET /guacamole/api/ (returns API version). path: Read check_headscale Check Headscale (self-hosted Tailscale control server) health via GET /health. Returns healthy/reachable statu Read check_healthchecks Check Healthchecks.io (self-hosted) cron job monitoring reachability via GET /. Returns 200 when service is up Read check_hedgedoc Check HedgeDoc collaborative markdown notes server health via GET /api/v2/status. Returns version and connecti Read check_heimdall Check Heimdall application dashboard reachability via GET /. Default port 80. Read check_hoarder Check Hoarder bookmarks manager reachability via GET /api/v1/health. Default port 3000. Read check_homarr Check Homarr dashboard reachability via GET /api/health. Default port 7575. Read check_homeassistant Check Home Assistant health via GET /api/. Returns running state and version. token: optional long-lived acces Read check_homepage Check Homepage dashboard (gethomepage.dev) health via GET /api/healthcheck. Returns healthy status. Default po Read check_hoppscotch Check Hoppscotch self-hosted API testing platform backend health via GET /api/health or root path. Default bac Read check_icinga Check Icinga (monitoring) reachability via GET /icingaweb2/. Default port 80. Read check_immich Check Immich photo management server health via GET /api/server-info/ping. Returns ping response. Read check_influxdb Check InfluxDB server health. Supports both InfluxDB v2 (GET /health → JSON status/pass) and v1 (GET /ping → 2 Read check_invidious Check Invidious YouTube frontend reachability via GET /api/v1/stats. Returns software version when healthy. De Read check_invoiceninja Check Invoice Ninja health via GET /api/v1/ping. Returns version if the API responds. A 401/403 response also Read check_it_tools Check IT Tools developer utility hub reachability via GET /. Default port 80. Read check_jackett Check Jackett indexer proxy reachability via GET /health. Returns healthy when service responds. Default port Read check_jaeger Check Jaeger distributed tracing UI and query API via GET / (UI) and /api/services. Returns whether the UI is Read check_jellyfin Check Jellyfin media server health via GET /health. Returns health status and version from public system info. Read check_jellyseerr Check Jellyseerr media request and discovery manager health via GET /api/v1/status. Returns version string. De Read check_joplin_server Check Joplin Server note-syncing backend health via GET /api/ping. Returns status 'ok'. Default port 22300. Read check_kafka Check Apache Kafka broker availability. Sends a minimal API Versions request (Kafka protocol v0) and verifies Read check_karakeep Check Karakeep (formerly Hoarder) AI bookmark manager health via GET /api/v1/health. Returns healthy/reachable Read check_kasm Check Kasm Workspaces containerized desktop reachability via GET /. Default port 443 with HTTPS. Read check_kavita Check Kavita manga, comic, and book reader server health via GET /api/health. Default port 5000. Read check_keycloak Check Keycloak identity server health via GET /health/live and /health/ready (Keycloak 20+). Falls back to /au Read check_kibana Check Kibana (Elastic Stack UI) reachability via GET /api/status. Default port 5601. Returns overall status co Read check_kimai Check Kimai time-tracking application health via GET /api/version. Returns version string. Default port 80. Read check_komga Check Komga comics/manga server health via GET /actuator/health. Returns healthy status, server version if ava Read check_kubernetes_api Check Kubernetes API server health via the /healthz and /version endpoints. Returns API server liveness, indiv Read check_ldap Check LDAP server connectivity and verify it speaks the LDAP protocol. Sends an anonymous LDAPv3 bind request Read check_leantime Check Leantime project management service reachability via GET /. Returns 200 or 302 when service is up. Defau Read check_librenms Check LibreNMS (network monitoring) reachability via GET /. Default port 80. Read check_lidarr Check Lidarr music collection manager health via GET /api/v1/system/status. Returns version and startup time. Read check_limesurvey Check LimeSurvey survey platform health via GET /index.php. A 200 or redirect response confirms the service is Read check_linkding Check Linkding bookmark manager health via GET /health. Returns healthy/reachable status. Default port 9090. Read check_linkwarden Check Linkwarden bookmark manager availability via GET /api/v1/auth/session (returns 401 without auth, confirm Read check_listmonk Check listmonk newsletter/mailing list manager health via GET /api/health. Returns healthy/reachable status an Read check_loki Check Grafana Loki log aggregation service via GET /ready and /loki/api/v1/status/buildinfo. Returns readiness Read check_matomo Check Matomo web analytics health via the API ping endpoint. Returns version if the API responds. Default port Read check_matrix_synapse Check Matrix Synapse homeserver health via GET /_matrix/federation/v1/version (public endpoint). Returns serve Read check_mattermost Check Mattermost team messaging server health via GET /api/v4/system/ping. Returns status and database health. Read check_maybe Check Maybe personal finance manager reachability via GET /. Returns 200 or 302 when service is up. Default po Read check_mealie Check Mealie recipe manager health via GET /api/about. Returns version and build info. Read check_memcached Connect to a Memcached server and request its version. Returns whether the server is reachable and its version Read check_memos Check Memos self-hosted lightweight notes server health via GET /api/v1/workspace/profile. Returns version. De Read check_mimir Check Grafana Mimir (scalable Prometheus) reachability via GET /ready. Default port 8080. Returns ready status Read check_miniflux Check Miniflux RSS reader health via GET /healthcheck. Returns healthy state. Read check_minio Check MinIO object storage availability via GET /minio/health/live (liveness) and /minio/health/ready (readine Read check_mongodb Connect to a MongoDB server and send a hello command via the MongoDB wire protocol (OP_MSG). Returns whether t Read check_monica Check Monica personal CRM availability. Monica has no dedicated health endpoint; checks if the main page retur Read check_mylar3 Check Mylar3 comics manager health via GET /api?apikey=nokey&cmd=getVersion (returns 401/403 if auth required, Read check_n8n Check n8n workflow automation platform health via GET /healthz. Returns status 'ok'. Default port 5678. Read check_navidrome Check Navidrome music streaming server health via GET /app/manifest.json (public endpoint). Returns reachable Read check_neo4j Check Neo4j graph database availability via the HTTP API. GET / returns server version and available endpoints Read check_netbird Check NetBird VPN management server health via GET /api/v1/self-hosted/setup-keys (returns 200 or 401 when ser Read check_netdata Check Netdata real-time performance monitoring server health via GET /api/v1/info. Returns version and operati Read check_nextcloud Check Nextcloud/ownCloud instance health via GET /status.php. Returns installed, maintenance mode, and version Read check_nfs Check NFS file server availability. Verifies TCP connectivity on both the portmapper (111) and NFS (2049) port Read check_nitter Check Nitter Twitter/X frontend reachability via GET /. Default port 8080. Read check_nocodb Check NocoDB no-code database platform health via GET /api/v1/health. Returns status 'ok'. Default port 8080. Read check_ntfy Check ntfy push notification server health via GET /v1/health. Returns healthy state and version. Read check_ntopng Check ntopng (network traffic monitoring) reachability via GET /. Default port 3000. Read check_nzbget Check NZBGet usenet downloader health via GET /. 200 or 401 (basic auth) = healthy. Default port 6789. Read check_ollama Check Ollama LLM server health via GET /api/version. Returns version string. Default port 11434. Read check_onlyoffice Check OnlyOffice Document Server health via GET /healthcheck. Returns 'true' on success. Default port 80. Read check_open_webui Check Open WebUI (Ollama/LLM frontend) health via GET /health. Returns healthy status. Default port 3000. Read check_openproject Check OpenProject project management reachability via GET /api/v3/configuration. Returns 200 or 401 when servi Read check_opensearch Check OpenSearch (or Elasticsearch-compatible) cluster health via GET /_cluster/health. Returns cluster name, Read check_organizr Check Organizr v2 dashboard reachability via GET /api/v2/apps. Default port 80. Read check_outline Check Outline wiki/knowledge base health via GET /api/_healthcheck. Returns healthy state. Read check_overseerr Check Overseerr media request manager reachability via GET /api/v1/status. Returns version when healthy. Defau Read check_paperless Check Paperless-NGX document management health. Attempts GET /api/ (returns 401 without auth, confirming servi Read check_penpot Check Penpot open-source design tool health via GET /api/rpc/command/get-profile. 401 = running (auth required Read check_photoprism Check PhotoPrism photo management server health via GET /api/v1/status. Returns running state and version. Read check_pihole Check Pi-hole DNS ad blocker status via the admin API. Returns enabled, blocking status, DNS queries today, an Read check_planka Check Planka kanban project management board health via GET /api/health or root path. 200 or 401 = healthy. De Read check_plausible Check Plausible Analytics health via GET /api/health. Returns database and clickhouse status. Read check_plex Check Plex Media Server reachability via GET /identity. Returns server version and machine identifier when hea Read check_pocketbase Check PocketBase backend health via GET /api/health. Returns healthy status. Default port 8090. Read check_portainer Check Portainer container management UI health via GET /api/status. Returns version and instance ID. Read check_postgres Connect to a PostgreSQL server and read the server version from the startup response. Does not authenticate. U Read check_prometheus Check Prometheus monitoring service health. Queries /-/healthy and /-/ready endpoints and returns status. Also Read check_prowlarr Check Prowlarr indexer manager health via GET /api/v1/system/status. Returns version and startup time. Default Read check_qbittorrent Check qBittorrent Web UI health via GET /api/v2/app/version. Returns version string. 403 = running but not log Read check_rabbitmq check_rabbitmq Read check_radarr Check Radarr movie manager reachability via GET /api/v3/health. Returns healthy when service responds. Default Read check_radicale Check Radicale CalDAV/CardDAV server reachability via GET /. Returns 200 or 401 when service is up. Default po Read check_rallly Check Rallly open-source scheduling and polls application health via GET /api/health or root. Default port 300 Read check_readarr Check Readarr book/eBook collection manager health via GET /api/v1/system/status. Returns version and startup Read check_redis check_redis Read check_redlib Check Redlib (private Reddit frontend) reachability via GET /. Default port 8080. Read check_sabnzbd Check SABnzbd usenet downloader health via GET /sabnzbd/. 200 or redirect to login page = healthy. path: conte Read check_scrutiny Check Scrutiny disk health monitoring health via GET /api/health. Returns healthy/reachable status. Default po Read check_seafile Check Seafile file sync and share server health via GET /api2/ping/. Returns 'pong' on success. Default port 8 Read check_searxng Check SearXNG meta-search engine availability via GET /healthz. Falls back to checking the homepage returns 20 Read check_security_headers Fetch HTTP response headers and report which security headers are present or missing: HSTS, CSP, X-Frame-Optio Read check_shiori Check Shiori bookmark manager reachability via GET /. Returns 200 or 302 (redirect to login) when service is u Read check_signoz Check SigNoz (OpenTelemetry observability) reachability via GET /api/v1/health. Default port 3301. Returns sta Read check_sip Check a SIP (Session Initiation Protocol) server by sending an OPTIONS probe. port: default 5060 (UDP/TCP) or Read check_smb Check SMB/CIFS file-sharing service reachability. Sends an SMB2 Negotiate request and verifies the response ma Read check_snipe_it Check Snipe-IT IT asset management application health via GET /api/v1/settings/general (401 without token = ru Read check_sonarr Check Sonarr TV series manager reachability via GET /api/v3/health. Returns healthy when service responds. Def Read check_speedtest_tracker Check Speedtest Tracker reachability via GET /api/healthcheck. Default port 80. Read check_spf Check the SPF (Sender Policy Framework) record for a domain. Looks up TXT records at the domain root and extra Read check_stirling_pdf Check Stirling-PDF tools server health via GET /api/v1/info. Returns healthy state and version. Read check_strapi Check Strapi headless CMS reachability via GET /api/health-check. Returns status when healthy. Default port 13 Read check_syncthing Check Syncthing file sync service health via GET /rest/noauth/health. Returns status and version. api_key: opt Read check_tandoor Check Tandoor recipe manager health via GET /api/schema/ (public OpenAPI schema endpoint). Returns reachable s Read check_tautulli Check Tautulli Plex statistics reachability via GET /status. Returns healthy when service responds. Default po Read check_technitium Check Technitium DNS Server reachability via GET /api/user/login (returns an API error indicating the server i Read check_tempo Check Grafana Tempo distributed tracing service via GET /ready and /api/echo. Returns readiness status and whe Read check_traefik Check Traefik reverse proxy health via GET /ping (returns 'OK') and GET /api/version. Port 8080 is the default Read check_transmission Check Transmission BitTorrent client RPC health via GET /transmission/rpc. A 409 response (CSRF token required Read check_trilium Check Trilium Notes hierarchical note-taking app reachability via GET /. Default port 8080. Read check_tubearchivist Check TubeArchivist (YouTube archiver) health via GET /api/ping/. Returns healthy status and version info. Def Read check_umami Check Umami privacy-focused analytics server health via GET /api/heartbeat. Returns 'OK' text response. Defaul Read check_uptime_kuma Check Uptime Kuma monitoring service health via GET /api/health. Returns health status and version if availabl Read check_vault check_vault Read check_vaultwarden Check Vaultwarden (Bitwarden-compatible) password manager health via GET /alive. Returns health status. Read check_vector Check Vector (log pipeline) reachability via GET /health. Default port 8686. Returns healthy status and compon Read check_victoriametrics Check VictoriaMetrics (time-series database) health via GET /health and retrieve /api/v1/status/tsdb summary. Read check_vikunja Check Vikunja task manager health via GET /api/v1/info. Returns version and build information. Read check_vnc Connect to a VNC server and read the RFB protocol banner. Returns whether the server is reachable, the RFB ver Read check_wallabag Check Wallabag read-it-later service availability. Checks GET /api/info (401 without auth = running) or homepa Read check_wallos Check Wallos subscription tracker reachability via GET /. Default port 8282. Read check_wazuh Check Wazuh security platform API reachability via GET /. Default port 55000 with HTTPS. Returns 401 when up ( Read check_whoogle Check Whoogle search engine reachability via GET /. Returns healthy when main page loads. Default port 5000. Read check_wikijs Check Wiki.js health via GET /healthcheck. Returns healthy status. Default port 3000. Read check_windmill Check Windmill workflow automation platform health via GET /api/version. Returns version string. Default port Read check_wordpress Check WordPress site health via GET /wp-json/. Returns site name and description. Default port 80. Read check_zabbix Check Zabbix (enterprise monitoring) reachability via GET /zabbix/. Default port 80. Read check_zipkin Check Zipkin (distributed tracing) health via GET /health and retrieve service count from /api/v2/services. Re Read check_zipline Check Zipline file sharing server health via GET /api/server/info. Returns version and build info. Read check_zookeeper Check ZooKeeper server health using the 'ruok' four-letter word command. Also attempts 'stat' to return mode ( Read dns_bulk_lookup Look up DNS records for multiple hostnames in one call. hosts: comma-separated list (e.g., 'google.com,github. Read dns_lookup Look up DNS records for a hostname. record_type: A, AAAA, MX, TXT, NS, CNAME, PTR, SOA, SRV. nameserver: optio Read dns_propagation Check DNS propagation across 4 major public resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9, Open Read dnssec_check Check DNSSEC status for a domain: whether DNSKEY records are published, RRSIG signatures are present on A reco Read ftp_check Connect to an FTP server and read its banner. Also tests whether anonymous login is accepted. Useful for verif Read geolocation Look up geolocation data for a public IP address: country, region, city, ISP, and coordinates. Uses ipinfo.io Read get_public_ip Return the public IP address of the machine running this MCP server, plus basic geolocation (country, region, Read health_check Health check endpoint for container monitoring. Read http_check http_check Read http_redirect_chain Follow an HTTP/HTTPS URL through all redirects and return every hop with status code and Location header. Usef Read http_security_headers Audit HTTP security headers on a web server. Checks for: Strict-Transport-Security, Content-Security-Policy, X Read imap_check Check IMAP server connectivity. Reads server greeting and capabilities. Tests STARTTLS for port 143; uses impl Read local_ports List listening TCP and UDP ports on the local machine. protocol: 'tcp', 'udp', or 'all'. show_processes: inclu Read mac_lookup Look up the vendor/manufacturer for a MAC address (OUI database). Read mysql_check Connect to a MySQL/MariaDB server and read the server greeting to extract the server version. Does not authent Read network_interfaces List all local network interfaces with their IP addresses, subnet prefix length, and link state. Structured ou Read ntp_check Check an NTP server: reachability and clock offset relative to local system time. Uses NTPv3 client packet ove Read ping_sweep Ping all hosts in an IPv4 CIDR range and report which respond. Max /24 (256 addresses). Runs parallel pings. t Read pop3_check Check POP3 server connectivity. Reads server greeting and tests STARTTLS capability for port 110; uses implici Read port_check Check if a TCP port is open on a host. port: 1-65535. timeout: 1-300 s. Supports IPv4 and IPv6. Read reverse_dns Reverse DNS lookup for an IP address — returns the PTR hostname. Read reverse_dns_bulk Reverse DNS lookup for multiple IP addresses at once. ips: comma-separated IPv4 or IPv6 addresses (max 50). Re Read scan_common_ports Scan 17 commonly used ports on a host and report which are open (FTP, SSH, HTTP, HTTPS, SMTP, DNS, MySQL, Post Read smtp_check Check an SMTP server: connectivity, banner, advertised capabilities, and STARTTLS support. port: 25 (SMTP), 46 Read snmp_check Send an SNMPv2c GetRequest for sysDescr (OID 1.3.6.1.2.1.1.1.0) over UDP and verify the response. community: S Read ssh_check Check SSH server connectivity and retrieve the server banner (SSH version string, e.g. 'SSH-2.0-OpenSSH_8.9'). Read subnet_info Parse an IPv4 or IPv6 CIDR block: network address, host range, host count, and whether it is a private range. Read tcp_banner Connect to any TCP port and read the initial server banner. Useful for identifying unknown services or verifyi Read tls_version_check Test which TLS protocol versions a server accepts (TLS 1.2, TLS 1.3). Also returns the negotiated cipher suite Read whois Look up WHOIS registration data for a domain or IP address. Output is truncated at 8000 characters.
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
adminautomation
Nodebench 824 tools
adminautomation
Yaver 812 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Crow 587 tools
adminautomation
Fortimanager 584 tools
adminautomation
TinyFn 572 tools
adminautomation
Mcp 571 tools
adminautomation
FAQ

Questions about Mcp Nettools

Can an AI agent delete data through the Mcp Nettools MCP server? +

Yes. The Mcp Nettools server exposes 1 destructive tools including http_delete. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Mcp Nettools? +

The Mcp Nettools server has 2 write tools including http_patch, http_put. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Mcp Nettools.

How many tools does the Mcp Nettools MCP server expose? +

235 tools across 4 categories: Destructive, Execute, Read, Write. 224 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on Mcp Nettools? +

Register the Mcp Nettools MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Mcp Nettools tool call.

Deterministic rules across all 235 Mcp Nettools tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MCP NETTOOLS →

Instant setup, no code required.

235 Mcp Nettools tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Mcp Nettools's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.