Free vs paid networking MCP servers you can't outsource your own router.

A hosted vendor cannot port-forward into your homelab or read packets inside your cluster. Tools like kubefwd (Kubernetes port forwarding with automatic /etc/hosts entries) and Kubeshark MCP only work because they run where your infrastructure lives. The same is true of kubernetes-mcp-server for cluster operations and Komodo MCP Server for your Docker deployments.

When software must execute inside your trust boundary, open source isn't just cheaper — it's the only model that works. Expect this category's core to stay free indefinitely.

An agent with router access is one bad tool call away from locking you out of your own network. The better servers treat this as a design problem: mikrotik-mcp exposes firewall, NAT, and WireGuard config over SSH, and its sibling MikroMCP in the monitoring world advertises dry-run, RBAC, and rollback for a reason. Read-only modes and confirmation gates are worth more than any feature list here.

Budget your evaluation time accordingly: in this category you're auditing what an agent is allowed to break, not comparing prices.

Some networking jobs are better done from outside your network, and those price naturally per call: DNS propagation checks from multiple regions, TLS certificate chain validation, IP reputation lookups, port scans of your public surface, traceroutes from somewhere that isn't you. Utility bundles like ToolPipe MCP Server hint at this shape — DNS, hashing, screenshots — as discrete operations rather than ongoing service.

Registrar bridges sit in between: Porkbun DNS and spaceship-mcp are free connectors, but the domains and certificates they manage are paid products you already buy from the registrar.

An external check endpoint with x402 charges from $0.01 per operation: the agent gets HTTP 402, pays USDC on Base, settlement lands in roughly two seconds, and the check executes after payment — returning results with an Ed25519-signed receipt. For infrastructure agents, the receipt doubles as an audit artifact: verifiable evidence that the DNS check ran, when, and from whom.

No signup is the killer feature in this niche. A deploy agent needing one propagation check shouldn't hold an account anywhere.

Self-host free servers for everything inside your trust boundary — that's most of the category, from UniFi Network MCP to devcontainer-mcp. Pay per call only for external vantage points and one-off diagnostics. All 64 live listings, with x402 pricing where set, are on Loomal's Networking & Infrastructure category page.