FortiGate MCP Server

A production-ready Model Context Protocol (MCP) server for managing FortiGate firewalls

Features • Quick Start • Configuration • Tools • Architecture • Security • Testing

Overview

FortiGate MCP Server exposes FortiGate firewall management capabilities through the Model Context Protocol, enabling AI assistants and MCP-compatible tools to programmatically manage firewall policies, network objects, routing, and device configurations.

Built with fully async Python, persistent HTTP connection pooling, and security-first defaults.

Features

Device Management

• Multi-device support with concurrent management
• API token and basic authentication
• Connection testing and health monitoring
• VDOM discovery and per-VDOM operations

Firewall Policy Management

• Full CRUD for firewall policies
• Policy detail with address/service object resolution
• VDOM-scoped operations

Network Object Management

• Address objects (subnet, IP range, FQDN)
• Service objects (TCP/UDP/SCTP with port ranges)

Virtual IP Management

• NAT/DNAT virtual IPs
• Port forwarding configuration
• Protocol-specific VIP rules

Routing

• Static route CRUD operations
• Routing table inspection
• Interface listing and status monitoring

Infrastructure

• Fully async API client with httpx.AsyncClient connection pooling
• STDIO and HTTP transport modes
• Pydantic configuration models with validation
• Structured logging with API call tracing
• Rate limiting support

Quick Start

Prerequisites

• Python 3.11+
• Access to a FortiGate device with API enabled
• API token (recommended) or admin credentials

Installation

git clone https://github.com/Aprazor/fortigate-mcp-server.git
cd fortigate-mcp-server

python -m venv .venv
source .venv/bin/activate  # Linux/macOS
# .venv\Scripts\activate   # Windows

pip install -e .

Configuration

Create a configuration file (e.g., config/config.json):

{
  "fortigate": {
    "devices": {
      "fw-primary": {
        "host": "192.168.1.1",
        "port": 443,
        "api_token": "your-api-token-here",
        "vdom": "root",
        "verify_ssl": true,
        "timeout": 30
      }
    }
  },
  "server": {
    "name": "fortigate-mcp-server",
    "host": "0.0.0.0",
    "port": 8814
  },
  "auth": {
    "require_auth": false,
    "allowed_origins": []
  },
  "logging": {
    "level": "INFO",
    "console": true
  }
}

Run the Server

STDIO mode (for direct MCP client integration):

export FORTIGATE_MCP_CONFIG=config/config.json
python -m src.fortigate_mcp.server

HTTP mode (for web-based access):

python -m src.fortigate_mcp.server_http \
  --host 0.0.0.0 \
  --port 8814 \
  --config config/config.json

MCP Client Integration

Claude Desktop / Claude Code (~/.claude/mcp_servers.json):

{
  "mcpServers": {
    "fortigate": {
 

... [View full README on GitHub](https://github.com/alpadalar/fortigate-mcp-server#readme)