NTopNG-MCP

# ntopng MCP Server Read-only MCP server that exposes ntopng network monitoring data as tools. Runs on **openclaw-pc** (user: `dumaki`) alongside existing MCP servers. ntopng is at `http://100.115.252.53:3000` (Raspberry Pi, Docker). --- ## Security model * Each tool call performs a fresh `POST /authorize.json`, makes **one GET request**, then immediately calls `POST /logout.json`. * Sessions are **never** cached between calls. * Credentials and session tokens are **never** logged. * Every function has an explicit path allowlist that blocks anything other than the authorised auth/logout endpoints and paths under `/lua/rest/v2/get/`. --- ## 1 Add credentials to the existing .env Append the following two lines to `/etc/sherman-executor/.env` on **openclaw-pc** (you need `sudo`): ```bash sudo tee -a /etc/sherman-executor/.env <<'EOF' NTOPNG_USERNAME=admin NTOPNG_PASSWORD=your_ntopng_password_here EOF ``` Verify the file is not world-readable: ```bash sudo chmod 640 /etc/sherman-executor/.env sudo chown root:sherman-executor /etc/sherman-executor/.env ``` --- ## 2 Install Python dependencies ```bash cd /opt/ntopng-mcp # or wherever you deploy the server python3 -m venv .venv source .venv/bin/activate pip install -r requirements.txt ``` --- ## 3 Register in OpenClaw MCP config Add the following entry to your OpenClaw MCP server configuration file (typically `~/.config/openclaw/mcp_servers.json` or wherever your existing servers are listed): ```json { "ntopng": { "command": "/opt/ntopng-mcp/.venv/bin/python", "args": ["/opt/ntopng-mcp/ntopng_mcp_server.py"], "env": { "NTOPNG_BASE_URL": "http://100.115.252.53:3000" } } } ``` The server reads credentials from `/etc/sherman-executor/.env` automatically; you do **not** pass them in the config. Restart OpenClaw (or reload its MCP server list) after saving the config. --- ## 4 Test each tool with curl All examples assume ntopng is at `http://100.115.252.53:3000`. ### 4a Authenticate manually and grab a cookie ```bash COOKIE=$(curl -s -c - -X POST \ "http://100.115.252.53:3000/authorize.json" \ -d "username=admin&password=YOUR_PASSWORD" \ | grep -oP '(?<=\t)\S+$' | tail -1) ``` Or use a cookie jar: ```bash curl -s -c /tmp/ntopng.cookies -X POST \ "http://100.115.252.53:3000/authorize.json" \ -d "username=admin&password=YOUR_PASSWORD" ``` Use `-b /tmp/ntopng.cookies` in all subsequent requests, then logout: ```bash curl -s -b /tmp/ntopng.cookies -X POST \ "http://100.115.252.53:3000/logout.json" ``` --- ### 4b ntopng_get_interface_stats ```bash # List interfaces curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/interface/list.lua" # Stats for interface 0 curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/interface/data.lua?ifid=0" ``` ### 4c ntopng_get_host_traffic ```bash curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/host/active.lua?ifid=0&sortColumn=column_traffic&sortOrder=desc&perPage=25&currentPage=1" ``` ### 4d ntopng_get_active_flows ```bash curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/flow/active.lua?ifid=0&sortColumn=column_bytes&sortOrder=desc&perPage=50&currentPage=1" ``` ### 4e ntopng_get_alerts ```bash curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/alert/alerts.lua?perPage=50&currentPage=1&sortColumn=column_date&sortOrder=desc" ``` ### 4f ntopng_search_host ```bash # Replace 192.168.1.10 with the IP you want to inspect curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/host/data.lua?host=192.168.1.10&ifid=0" curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/flow/active.lua?ifid=0&host=192.168.1.10&perPage=50&currentPage=1" curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/alert/alerts.lua?ip=192.168.1.10&perPage=50&currentPage=1" ``` ### 4g ntopng_get_top_protocols ```bash curl -s -b /tmp/ntopng.cookies \ "http://100.115.252.53:3000/lua/rest/v2/get/interface/l7/stats.lua?ifid=0" ``` --- ## 5 Verify the MCP server starts ```bash cd /opt/ntopng-mcp source .venv/bin/activate python ntopng_mcp_server.py ``` A healthy start emits no output to stdout (MCP protocol uses stdin/stdout). Any errors (missing credentials, unreachable ntopng) print to stderr. --- ## Environment variables | Variable | Default | Purpose | |---|---|---| | `NTOPNG_BASE_URL` | `http://100.115.252.53:3000` | ntopng base URL | Credentials come exclusively from `/etc/sherman-executor/.env`.