{
  "markdown": "<!-- mcp-name: io.github.shigechika/netdiag-mcp -->\n\n# netdiag-mcp\n\nEnglish | [日本語](README.ja.md)\n\nMCP server for on-demand network diagnostics — DNS lookups (with a DNSSEC AD-bit check), ping, an `mtr`-based path report, TCP port checks, HTTP status/redirect checks, TLS certificate inspection, and WHOIS, all from one server.\n\nBuilt for triaging \"can't reach X\" / \"is DNS propagated yet\" reports without shelling into a jump host for each one-off `dig`/`ping`/`curl`.\n\n## Tools\n\n| Tool | Purpose |\n|---|---|\n| `dns_lookup` | Resolve a DNS record via `dig` (A/AAAA/MX/TXT/NS/CNAME/SOA/PTR/CAA), optionally against a specific resolver and over plain DNS/DoT/DoH |\n| `dnssec_check` | Query a known-validating resolver and report whether the AD bit is set (plain/DoT/DoH) — the only reliable way to confirm DNSSEC validation, since an RRSIG being present in a plain `dig` reply does not by itself prove anything validated it |\n| `ping_host` | ICMP ping (count clamped to 1-10) |\n| `traceroute_path` | Hop-by-hop path/loss report via `mtr --report` (fixed cycles, not a live/continuous run) |\n| `tcp_port_check` | Is a TCP port open — a plain socket connect, not a port scan |\n| `http_check` | HEAD/GET a URL and report status, redirect chain, and latency |\n| `tls_cert_check` | Fetch the certificate a host presents and report subject/issuer/validity/SANs |\n| `whois_lookup` | WHOIS lookup for a domain |\n| `asn_lookup` | ASN + country-code lookup for an IP, or org info for an AS number, via Team Cymru's whois service — no API key or GeoIP database needed |\n| `health_check` | Version and which wrapped binaries (`dig`/`ping`/`mtr`/`whois`) are present on PATH |\n\nAll tools are read-only and single-target (no batch/sweep mode) — this is a\nconvenience wrapper around checks an operator would run by hand, not a\nscanning tool. `nmap`-style multi-host/multi-port scanning is intentionally\nout of scope; deliberately probing many hosts or ports is a different,\nhigher-blast-radius action that deserves its own tooling and approval flow.\n\n`tcp_port_check`, `http_check` and `tls_cert_check` use Python's own\nsocket/ssl/httpx stack rather than shelling out to `nc`/`curl`/`openssl`, so\nthose three tools work even on a host with only the `dig`/`ping`/`mtr`/`whois`\nbinaries installed (or none of them — `health_check` reports which are\nmissing without failing the whole server).\n\n`dns_lookup`/`dnssec_check` support DNS-over-TLS and DNS-over-HTTPS via\n`transport=\"dot\"`/`\"doh\"` (dig's `+tls`/`+https`). This needs `dig` from\nBIND 9.18+ — an older `dig` rejects the flag outright rather than silently\nfalling back to plain DNS, so a stale binary fails loudly instead of giving\na false sense of having checked over an encrypted transport.\n\n`tls_cert_check`/`http_check` against a bare IP address can fail TLS\nhandshake with a \"handshake failure\" or similar error on SNI-hosted /\nCDN-fronted origins (e.g. behind Cloudflare) — TLS's SNI extension only\ncarries hostnames, so an IP literal can't route to the right certificate on\na shared edge. This is normal TLS behavior, not a tool bug; check by\nhostname when the target is CDN-fronted.\n\n## Setup\n\n### 1. System dependencies\n\n`dns_lookup`, `dnssec_check`, `ping_host`, `traceroute_path` and\n`whois_lookup` shell out to `dig`, `ping`, `mtr` and `whois` respectively.\nInstall whichever of these you want available:\n\n```bash\n# Debian/Ubuntu\nsudo apt install dnsutils iputils-ping mtr-tiny whois\n```\n\n`mtr` needs raw-socket access. Debian/Ubuntu's `mtr-tiny` package grants\n`cap_net_raw` to the `mtr-packet` helper at install time, so it normally\nworks for an unprivileged service user without further setup — verify with\n`getcap \"$(command -v mtr-packet)\"` if `traceroute_path` reports a socket\npermission error. Without that capability, `traceroute_path` fails cleanly\nwith a `ToolError` rather than crashing the server.\n\n### 2. Install\n\n```bash\npip install netdiag-mcp\n# or\nuv tool install netdiag-mcp\n```\n\n### 3. Claude Code (plugin)\n\nThis repository doubles as a single-plugin marketplace, so Claude Code can install\nthe server for you:\n\n```\n/plugin marketplace add shigechika/netdiag-mcp\n/plugin install netdiag-mcp@netdiag-mcp\n```\n\nThe plugin launches `uvx netdiag-mcp`. No environment variables are required — the\nonly prerequisite is the system dependencies above, and the TCP, HTTP and TLS\nchecks work even without them.\n\n`uvx` must be on the `PATH` of the process that runs Claude Code — a login\nshell usually has it, but a GUI-launched app may not; install\n[uv](https://docs.astral.sh/uv/) system-wide if the plugin fails to start.\n\n### 4. Claude Code (manual)\n\n```bash\nclaude mcp add netdiag -- netdiag-mcp\n```\n\nNo environment variables are required.\n\n## CLI\n\n```bash\nnetdiag-mcp --version   # print version\nnetdiag-mcp --check     # report which wrapped binaries are present (exit 0 when all are)\n```\n\n## Security notes\n\n- Every external-binary call passes an argv list (never a shell string), so\n  no tool argument can break out into shell syntax.\n- Hostname/IP and port arguments are validated and size/range-clamped before\n  use — tool input is model-driven and treated as untrusted, the same as any\n  other tool-calling surface.\n- `tcp_port_check` connects to exactly one host:port per call; there is no\n  loop or range argument, by design.\n\n## Development\n\n### Live smoke test\n\nUnit tests check logic against fixtures; they cannot tell you that a tool has\nstopped returning real data (a dead `dig`/`ping`/`mtr`/`whois` binary, a\nbroken TLS trust store, a network that blocks outbound ICMP). `scripts/\nsmoke_test.py` runs **every registered tool** against real public endpoints\nand fails on empty, malformed or error answers:\n\n```bash\nuv run python scripts/smoke_test.py\nuv run python scripts/smoke_test.py --only ping --traceback\n```\n\n- **No inventory, so every target is a fixed public endpoint** — Cloudflare's\n  `1.1.1.1` and IANA's `example.com` (reserved for documentation/testing use,\n  RFC 2606). This server takes no config and has nothing to discover a\n  target from, unlike a device-fleet MCP server in this family.\n- `tests/test_smoke_probes.py` is the offline half: it only checks that\n  every registered tool has a probe spec (and vice versa), so CI catches a\n  tool added without deciding how anyone would know it works, without\n  needing network access.\n\n## License\n\nMIT\n",
  "bytes": 6344,
  "sha": "259d39b27ec15341b16c0afbac227e0e6cdae1fbaebacb4403260581a82757d6",
  "repo_slug": "shigechika/netdiag-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_shigechika_netdiag_mcp_96bc54b8/readme"
}