net-mcp

MCP server for network engineering — BGP routing analysis, RPKI validation, DNSSEC-aware DNS, and historical route data from MRT archives.

Gives LLMs structured access to real network state using public data sources (RIPE RIS, RIPEstat, RPKI repositories, bgp.tools, bgproutes.io).

Example Queries

Once connected as an MCP server, an LLM can answer questions like:

• "Is 1.1.1.0/24 RPKI valid?" → rpki_validate
• "Who originates 8.8.8.0/24?" → bgp_prefix_origin
• "What does Cloudflare's AS footprint look like?" → bgp_asn_info(13335)
• "Is cloudflare.com DNSSEC signed?" → dns_lookup or dns_trace
• "Show me routes to 1.1.1.0/24 from Tokyo" → ris_collectors(region='asia') then bgp_route_lookup(prefix, collector='RRC06')
• "What did routing look like for 8.8.8.0/24 two days ago?" → mrt_search then bgp_historical_lookup
• "What route objects does AS13335 have in IRR?" → irr_route_lookup
• "Where does Cloudflare peer?" → peeringdb_network(13335)
• "What ASes are at AMS-IX?" → peeringdb_ix("AMS-IX", include_members=True)
• "Split 10.0.0.0/24 into /26s" → subnet_split
• "Is 192.168.1.1 a bogon?" → bogon_check
• "Do these two prefixes overlap?" → prefix_overlap
• "Ping 1.1.1.1 from my machine" → local_ping
• "What's my public IP?" → local_public_ip
• "Trace the path to 8.8.8.8" → local_traceroute
• "What ports are open on 192.168.1.1?" → local_nmap
• "Show my routing table" → local_routes

Tools

DNS

RPKI & ASPA

BGP — Live

BGP — Collectors & Historical

BGP — Security (Cloudflare Radar)

These tools require a Cloudflare Radar API token (CLOUDFLARE_API_TOKEN). Free to obtain at dash.cloudflare.com/profile/api-tokens.

IRR (Internet Routing Registry)

PeeringDB

IP/Subnet Math & Bogon Detection

Local Diagnostics

Tools that run standard CLI commands on the user's machine. All inputs are validated and passed as list arguments to subprocess (never shell=True) to prevent command injection.

Tools that require admin privileges will attempt to run and return a clear error message if permission is denied. Cross-platform: macOS, Linux, and Windows.

Data Sources

Data sources are queried in this priority order:

All RIPEstat requests include sourceapp=net-mcp per their API guidelines.

Usage

With Claude Code

Add to your MCP server configuration (~/.claude/settings.json or project .claude/settings.json):

{
  "mcpServers": {
    "net-mcp": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/net-mcp", "net-mcp"]
    }
  }
}

Standalone

uv run net-mcp

Configuration

Settings are loaded from (in priority order):

1. Environment variables (NET_MCP_* prefix)
2. Config file (config.toml)
3. Built-in defaults

Config file is searched at:

1. Path in NET_MCP_CONFIG env var
2. ./config.toml (next to pyproject.toml)
3. ~/.config/net-mcp/config.toml

config.toml

[storage]
# Directory for downloaded MRT files (RIB dumps can be ~400MB each).
# Default: system temp directory (/tmp/net-mcp/mrt)
mrt_cache_dir = "/path/to/mrt/cache"

# Maximum cache size in GB. Oldest files are removed when exceeded.
mrt_max_cache_gb = 10

[api]
# bgproutes.io API key (or set BGPROUTES_API_KEY env var)
bgproutes_api_key = "your-key-here"

[bgp]
# Default RIPE RIS collector for queries
default_collector = "rrc00"

[dns]
# Default DNS resolver
resolver = "1.1.1.1"

Environment Variables

MRT File Caching

Historical BGP lookups download MRT files from the RIPE RIS archive. These files can be large:

• RIB dumps (bview): ~400MB each, created every 8 hours (00:00, 08:00, 16:00 UTC)
• Update files (updates): ~3MB each, created every 5 minutes

Downloaded files are cached at <mrt_cache_dir>/<collector>/<year.month>/<filename>.gz and reused on subsequent queries. The cache is automatically pruned when it exceeds mrt_max_cache_gb.

Development

git clone <repo>
cd net-mcp
uv sync --group dev
uv run pytest

License

MIT