{
  "port": 8222,
  "protocol": "tcp",
  "service": "NATS HTTP monitoring",
  "oneLiner": "The conventional HTTP monitoring port for a NATS server.",
  "whatItIs": "nats-server exposes monitoring endpoints — /varz, /connz, /routez, /jsz — over HTTP when you set http_port or pass -m, and 8222 is the conventional choice in NATS' own documentation. It is off until enabled, and it is separate from the client port on 4222. The endpoints are read-only but detailed: server configuration, every connected client, route topology and JetStream state. IANA leaves 8222 unregistered.",
  "exposure": {
    "verdict": "never",
    "note": "The monitoring endpoints have no authentication and enumerate your entire messaging topology; NATS' own hardening guidance is to keep this port off the internet."
  },
  "checkCommand": "curl -s --max-time 5 http://TARGET:8222/varz",
  "links": [
    {
      "title": "NATS — Monitoring (http_port 8222, /varz and friends)",
      "url": "https://docs.nats.io/running-a-nats-service/nats_admin/monitoring",
      "kind": "official-docs"
    },
    {
      "title": "nats-io/nats-server on GitHub",
      "url": "https://github.com/nats-io/nats-server",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 8222",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8222",
      "kind": "iana"
    }
  ],
  "ianaName": "Unassigned"
}