mcp-windows/src/tools/netstat.ts

/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 * SPDX-License-Identifier: GPL-3.0-or-later
 *
 * Tool: windows_network_connections (#23)
 */

import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { z } from 'zod';
import { runPowerShell } from '../shell.js';

export function registerNetstatTools(server: McpServer): void {
	server.tool(
		'windows_network_connections',
		'List active TCP/UDP network connections (like netstat). Shows local/remote address, state, and owning process.',
		{
			state: z.enum(['all', 'listen', 'established', 'time_wait', 'close_wait']).default('all').describe('Filter by state'),
			port: z.number().optional().describe('Filter by port number'),
			process_name: z.string().optional().describe('Filter by process name'),
			limit: z.number().default(50).describe('Max results'),
		},
		async ({ state, port, process_name, limit }) => {
			const stateMap: Record<string, string> = {
				listen: "| Where-Object { $_.State -eq 'Listen' }",
				established: "| Where-Object { $_.State -eq 'Established' }",
				time_wait: "| Where-Object { $_.State -eq 'TimeWait' }",
				close_wait: "| Where-Object { $_.State -eq 'CloseWait' }",
				all: '',
			};

			const portFilter = port
				? `| Where-Object { $_.LocalPort -eq ${port} -or $_.RemotePort -eq ${port} }`
				: '';

			const procFilter = process_name
				? `| Where-Object { $procName -like '*${process_name.replace(/'/g, "''")}*' }`
				: '';

			const ps = `
Get-NetTCPConnection -ErrorAction SilentlyContinue ${stateMap[state]} ${portFilter} | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  $procName = if ($proc) { $proc.ProcessName } else { '?' }
  [PSCustomObject]@{
    Proto = 'TCP'
    LocalAddr = "$($_.LocalAddress):$($_.LocalPort)"
    RemoteAddr = "$($_.RemoteAddress):$($_.RemotePort)"
    State = $_.State.ToString()
    PID = $_.OwningProcess
    Process = $procName
  }
} ${procFilter} | Select-Object -First ${limit} | ConvertTo-Json -Depth 3 -Compress`;

			const result = await runPowerShell(ps, { timeout: 15000 });
			if (result.exitCode !== 0) {
				return { content: [{ type: 'text', text: `Error: ${result.stderr}` }], isError: true };
			}

			if (!result.stdout) {
				return { content: [{ type: 'text', text: 'No connections found.' }] };
			}

			const conns = Array.isArray(JSON.parse(result.stdout)) ? JSON.parse(result.stdout) : [JSON.parse(result.stdout)];
			const lines = conns.map((c: { Proto: string; LocalAddr: string; RemoteAddr: string; State: string; PID: number; Process: string }) =>
				`${c.Proto}  ${c.LocalAddr.padEnd(22)}  ${c.RemoteAddr.padEnd(22)}  ${c.State.padEnd(12)}  ${String(c.PID).padStart(6)}  ${c.Process}`,
			);

			const header = `Proto  ${'Local Address'.padEnd(22)}  ${'Remote Address'.padEnd(22)}  ${'State'.padEnd(12)}  ${'PID'.padStart(6)}  Process`;
			return {
				content: [{ type: 'text', text: `${header}\n${'─'.repeat(100)}\n${lines.join('\n')}\n\n${conns.length} connections` }],
			};
		},
	);
}