Skip to main content
Glama
AutomateIP

fwrule-mcp

by AutomateIP
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

FWRule MCP — Firewall Rule Analyzer

An MCP server that analyzes firewall rule overlap, duplication, shadowing, and conflicts across multi-vendor firewall policies.

Supported Vendors

Vendor

Format

Versions

Palo Alto PAN-OS / Panorama

XML config export

9.x - 11.x

Cisco ASA

show running-config text

9.x+

Cisco FTD

JSON export from FMC

6.x - 7.x

Cisco IOS / IOS-XE

show running-config text

12.x - 17.x

Cisco IOS-XR

show running-config text

6.x+

Check Point

JSON show-access-rulebase

R80.x - R82.x

Juniper SRX

display set format

19.x+

Juniper Junos (MX/PTX/QFX)

display set format

18.x+

Nokia SR OS

MD-CLI info/flat format

20.x+

Fortinet FortiOS / FortiGate

show full-configuration text

6.x - 7.x

Related MCP server: fortigate-mcp

Quick Start

# Install
uv sync

# Run tests
uv run pytest

# Start the MCP server
uv run fwrule-mcp

MCP Tools

analyze_firewall_rule_overlap

Analyze whether a candidate firewall rule overlaps with an existing ruleset. Supports two input modes.

Mode 1 — Vendor-native configs (built-in parsers):

  • vendor — Vendor identifier (panos, asa, ftd, ios, iosxr, checkpoint, juniper, junos, sros, fortios)

  • ruleset_payload — Complete firewall config in vendor-native format

  • candidate_rule_payload — Single candidate rule in vendor-native format

  • os_version — Optional OS version string

  • context_objects — Optional JSON with supplemental object definitions

Mode 2 — Pre-normalized JSON (caller extracts structured rules):

  • existing_rules — JSON string: array of normalized rule objects

  • candidate_rule — JSON string: single normalized rule object

Shared:

  • candidate_position — Optional 1-based intended insertion position

Normalized rule schema:

{
  "id": "rule-1",
  "position": 1,
  "enabled": true,
  "action": "permit",
  "source_zones": ["trust"],
  "destination_zones": ["untrust"],
  "source_addresses": ["10.0.0.0/24", "192.168.1.0/24"],
  "destination_addresses": ["any"],
  "services": [{"protocol": "tcp", "ports": "443"}],
  "applications": ["any"]
}

Detects:

  • Exact duplicates

  • Shadowed rules (candidate would never fire)

  • Action conflicts (overlapping traffic, opposing actions)

  • Partial overlaps

  • Superset/subset relationships

parse_policy

Parse a vendor-native firewall config and return normalized JSON rules. Use this to inspect what the built-in parser extracts before running overlap analysis.

  • vendor — Vendor identifier

  • ruleset_payload — Complete firewall config

  • os_version — Optional OS version string

  • context_objects — Optional JSON with supplemental object definitions

Returns the same normalized schema accepted by analyze_firewall_rule_overlap.

batch_analyze_overlap

Analyze multiple candidate rules against the same existing ruleset in a single call. More efficient than calling analyze_firewall_rule_overlap multiple times — existing rules are parsed once and reused for each candidate.

  • existing_rules — Array of normalized rule objects (from parse_policy output)

  • candidate_rules — Array of candidate rule objects to analyze

Returns {"success": true, "results": [{"candidate_id": "...", ...analysis result...}, ...]}.

list_supported_vendors

List all supported firewall vendors with format requirements.

Testing

# Full test suite
uv run pytest

# Mock payload tests (vendor parsers)
uv run pytest tests/test_mock_payloads.py -v

# Normalized input tests
uv run pytest tests/test_normalized_input.py -v

# Testing agent with formatted report
uv run python tests/test_agent.py

# Single vendor / scenario
uv run python tests/test_agent.py --vendor panos --scenario conflict --verbose

Architecture

MCP Client Request
       │
       ├── Mode 1: vendor + raw config
       │         │
       │         v
       │    Vendor Parser (plugin registry)
       │    [PAN-OS │ ASA │ FTD │ IOS │ IOS-XR │ CP │ SRX │ Junos │ SR OS │ FortiOS]
       │         │
       │         v
       │    Normalization Layer (object resolution, address expansion)
       │         │
       │         └──────────────┐
       │                        v
       ├── Mode 2: normalized JSON ──> Schema Validation
       │                        │
       │                        v
       └──────────────────> Analysis Engine (6-dimension set intersection)
                                │
                                v
                          Result Generator
                                │
                                v
                       Compact JSON Response

License

Apache 2.0

Addendum: Why Two Input Modes?

This MCP server is designed for automated compliance checking over large firewall rulesets where false positives and false negatives have real security consequences. The architecture balances two competing concerns:

The case for built-in parsers (Mode 1)

Firewall configs contain named object graphs — a rule may reference PROD-SERVERS, which is an address group containing WEB-TIER and DB-TIER, each referencing CIDRs. Resolving these correctly requires recursive expansion with cycle detection and conservative fallback (unresolvable references treated as any to avoid false negatives). The built-in parsers do this deterministically. An LLM doing this via reasoning will occasionally miss nested group members or hallucinate resolutions — margins that matter for security policy decisions.

The case for normalized input (Mode 2)

The vendor parsers are the fragility source. Each parser is ~400 lines of format-specific code that can break when vendor OS versions change output formats. We've already seen bugs in the PAN-OS parser (wrong XML element selection in wrapped configs). When a parser gets a format wrong, the analysis engine produces incorrect results — and the caller has no way to know.

The hybrid solution

Mode 2 (normalized JSON) addresses the fragility problem while preserving correctness:

  • When the caller already has structured data (e.g., from a REST API, or when the AI agent can reliably extract fields), it bypasses the fragile parsers entirely and sends resolved addresses directly to the analysis engine.

  • When the caller has raw CLI/config output, Mode 1's parsers handle the complex extraction and object resolution.

  • parse_policy bridges the gap — the caller can inspect what the parser extracted, verify rule counts and address resolution, and decide whether to trust the parser output or re-extract manually.

The analysis engine — the part that does CIDR arithmetic, port range intersection, and multi-dimensional set comparison — is the irreplaceable value. It's vendor-agnostic, deterministic, and well-tested. The parsers are a convenience layer; the normalized schema is the true API surface.

Available Tools

4 tools
analyze_firewall_rule_overlapA

Analyze whether a candidate firewall rule overlaps with an existing ruleset. Detects exact duplicates, shadowed rules, action conflicts, and partial overlaps. Two input modes: (1) vendor-native configs via vendor + ruleset_payload + candidate_rule_payload, or (2) pre-normalized JSON via existing_rules + candidate_rule. Use parse_policy first to inspect parser output before analysis.

ParametersJSON Schema
NameRequiredDescriptionDefault
vendorNoVendor identifier. One of: "panos", "asa", "ftd", "ios", "iosxr", "checkpoint", "juniper", "junos", "sros", "fortios". Required for Mode 1 (vendor-native).
os_versionNoOptional OS version string for parser selection.
candidate_ruleNoSingle normalized rule object (same schema as existing_rules elements). Example: {"id": "candidate", "position": 1, "action": "permit", "source_addresses": ["10.20.35.76/32"], "destination_addresses": ["172.16.20.0/24"], "services": [{"protocol": "tcp", "ports": "6379"}]}. Required for Mode 2.
existing_rulesNoArray of normalized rule objects from parse_policy output. Each object: {"id": "rule_1", "position": 1, "action": "permit"|"deny", "source_addresses": ["10.0.0.0/8"], "destination_addresses": ["any"], "services": [{"protocol": "tcp", "ports": "443"}], "source_zones": ["any"], "destination_zones": ["any"], "applications": ["any"]}. Required for Mode 2.
context_objectsNoOptional JSON string with supplemental object definitions (address groups, service objects).
ruleset_payloadNoComplete firewall config in vendor-native text format (e.g. full 'show access-lists' output for IOS). Required for Mode 1.
candidate_positionNoOptional 1-based intended insertion position of the candidate rule.
candidate_rule_payloadNoSingle candidate rule in vendor-native text format (e.g. one ACL line for IOS). Required for Mode 1.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations. Description conveys non-destructive analysis and detection capabilities, but does not explicitly state idempotency or side-effect absence. Output schema exists, reducing need for return value details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: first states purpose, second lists detections, third explains modes and workflow. No wasted words, front-loaded with essential info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Explains prerequisite (use parse_policy) and input modes adequately. Omits mention of optional parameters but schema handles that. Output schema present so return values are covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%; description adds value by grouping parameters into two modes (vendor-native vs pre-normalized), which aids understanding beyond individual parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'analyze' and the resource 'firewall rule overlap', enumerating detection types like duplicates and shadowed rules. It distinguishes from siblings: batch_analyze_overlap is batch, parse_policy is preprocessing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly recommends using parse_policy before analysis and describes two input modes. Lacks explicit when-not-to-use guidance, but the modes imply appropriate contexts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

batch_analyze_overlapA

Analyze multiple candidate rules against the same existing ruleset in a single call. More efficient than calling analyze_firewall_rule_overlap multiple times — existing_rules is parsed once and reused for each candidate. Use parse_policy first to get normalized rules, then pass all candidates at once.

ParametersJSON Schema
NameRequiredDescriptionDefault
existing_rulesNoArray of normalized rule objects from parse_policy output. Parsed once and reused for all candidates.
candidate_rulesNoArray of candidate rule objects to analyze. Each object: {"id": "candidate-1", "position": 1, "action": "permit"|"deny", "source_addresses": ["CIDR"], "destination_addresses": ["CIDR"], "services": [{"protocol": "tcp", "ports": "443"}], "source_zones": ["any"], "destination_zones": ["any"], "applications": ["any"]}.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It reveals that existing_rules is parsed once and reused (a behavioral optimization), but does not disclose error handling, limitations, or whether the tool is read-only. More transparency on edge cases would improve the score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise, front-loaded sentences with no redundancy. Every sentence adds value: purpose, efficiency comparison, and prerequisite workflow.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has two well-described parameters, an output schema exists, and siblings are clearly listed, the description provides sufficient context: it explains the advantage over the sibling, the prerequisite step using parse_policy, and the usage pattern, making it complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions already explaining the structure and reuse behavior. The tool description reinforces the workflow but adds little new semantic insight beyond what the schema already provides, keeping the score at baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes multiple candidate rules against an existing ruleset in a single call, distinguishing it from the sibling analyze_firewall_rule_overlap by highlighting the efficiency of reusing parsed existing rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly recommends using parse_policy first to obtain normalized rules, advises to pass candidates all at once, and positions this tool as more efficient than calling the sibling multiple times, providing clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_supported_vendorsA

List all supported firewall vendors and their configuration format requirements. Use this to understand what vendor identifiers and payload formats are accepted by analyze_firewall_rule_overlap and parse_policy.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full disclosure burden. It correctly indicates a read-only listing operation and hints at the returned content (vendor identifiers and format requirements). While it does not detail output schema or performance traits, the tool is simple and zero-parameter, so the description is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: the first describes the action, the second provides usage context. No extraneous words, and critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, output schema exists), the description fully covers its purpose and context. It links to sibling tools, making clear how it fits into a larger workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is 100%. The description does not need to add parameter details. The baseline for no parameters is 4, and the description meets this by not requiring further clarification.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('supported firewall vendors and their configuration format requirements'). The purpose is unambiguous and distinct from sibling tools like analyze_firewall_rule_overlap, which consume this information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use this to understand what vendor identifiers and payload formats are accepted by analyze_firewall_rule_overlap and parse_policy.' This provides clear context and guidance on the tool's role in a workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

parse_policyA

Parse a vendor-native firewall config and return normalized JSON rules. Use this to inspect what the built-in parser extracts — verify rule counts, object resolution, and address expansion before running overlap analysis. The output uses the same normalized schema accepted by analyze_firewall_rule_overlap.

ParametersJSON Schema
NameRequiredDescriptionDefault
vendorYesVendor identifier. One of: "panos", "asa", "ftd", "ios", "iosxr", "checkpoint", "juniper", "junos", "sros", "fortios".
os_versionNoOptional OS version string for parser variant selection.
context_objectsNoOptional JSON string with supplemental object definitions (address groups, service objects).
ruleset_payloadNoComplete firewall config in vendor-native text format. For IOS: paste the full 'show access-lists <name>' output. For PAN-OS: paste the full XML config tree.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full burden. It describes the parse operation and output format, but does not disclose whether the tool is read-only or has side effects. The behavior is straightforward for a parsing tool, but lacks details like error handling or idempotency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences front-load the core functionality and immediately provide context for usage. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema, the description is adequate. It explains the purpose and how the output ties into analysis, though it could mention potential limitations like config size or parser constraints.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents parameters. The description adds value by explaining the output's relationship to another tool, but does not provide additional parameter-level details beyond what the schema offers.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Parse' and the resource 'vendor-native firewall config', with the outcome 'return normalized JSON rules'. It distinguishes from sibling tools by explicitly mentioning 'before running overlap analysis', referencing the analyzer tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'Use this to inspect ... before running overlap analysis.' This indicates when to use. It does not explicitly state when not to use, but the context implies it is for verification, not analysis. Sibling tool names provide further differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: parsing, listing vendors, single rule analysis, and batch analysis. No overlap or ambiguity.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern (e.g., analyze_firewall_rule_overlap, batch_analyze_overlap, list_supported_vendors, parse_policy), making them predictable.

Tool Count5/5

With 4 tools, the set is well-scoped for firewall rule overlap analysis, covering all necessary operations without being overly large or sparse.

Completeness5/5

The tool surface is complete for the domain: parsing configs, listing vendors, and performing both single and batch overlap analysis. No obvious gaps.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • fortigate-mcp

    oscardagrach
    A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that enables natural language management of FortiGate firewalls via the FortiOS REST API, offering 393 tools for system, policy, routing, VPN, and security configuration.
    MIT

  • Support Engineer MCP Server

    tsabra76
    -
    license
    Not graded
    quality
    B
    maintenance
    A vendor-agnostic MCP server for technical support engineers, providing knowledge search, ticket analysis, and resolution suggestions.

  • mcp-opnsense

    drmfar
    F
    license
    Not graded
    quality
    C
    maintenance
    MCP server for managing OPNsense firewalls, providing read-only tools for firewall rules, aliases, interface statistics, and gateway status with multi-instance support.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/AutomateIP/fwrule-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server