fortigate-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FORTIGATE_HOST | Yes | IP address of the FortiGate device | |
| FORTIGATE_TOKEN | Yes | API token from FortiGate REST API admin | |
| FORTIGATE_TIMEOUT | No | HTTP request timeout in milliseconds | 10000 |
| FORTIGATE_VERIFY_SSL | No | Whether to verify SSL certificate (set true if valid cert) | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| fortigate_get_system_statusA | Get FortiGate system status (firmware version, hostname, serial, uptime). Use this first to verify connectivity. |
| fortigate_list_address_groupsA | List all firewall address groups (just names). Use this to find which group contains a specific IP, or to see available groups before calling fortigate_get_address_group. |
| fortigate_get_address_groupA | Get full details of a specific address group, including all member IPs/addresses. Useful for finding which IPs are in groups like 'Wifi', 'IT Team', 'Only Use AI'. |
| fortigate_list_addressesA | List all firewall address objects (single IPs/subnets, just names). Useful for finding objects like 'ip068', 'ip080'. |
| fortigate_get_addressA | Get details of a specific firewall address object (the actual IP/subnet it represents). |
| fortigate_list_policiesA | List all firewall policies in order with key fields (id, name, src, dst, service, action). Top of list = highest priority. Use this to understand traffic flow rules. |
| fortigate_get_policyA | Get full details of a specific firewall policy by ID. |
| fortigate_list_webfilter_profilesA | List all web filter profiles (just names). |
| fortigate_get_webfilter_profileA | Get full details of a web filter profile, including URL filters (allow/block lists) and category filters. Useful for understanding what 'Only Use AI', 'Translator Google' profiles allow. |
| fortigate_list_servicesA | List all custom firewall services (just names). Useful for understanding services like 'Everest_default', 'anydesk_6568'. |
| fortigate_create_policyA | Safely create a firewall policy. Defaults to dry_run=true. To apply, set FORTIGATE_ENABLE_WRITE=true and pass confirm exactly as the configured confirmation phrase. |
| fortigate_update_policyA | Safely update a firewall policy. Reads the current policy first and defaults to dry_run=true. |
| fortigate_create_addressA | Safely create a firewall address object. Defaults to dry_run=true. To apply, set FORTIGATE_ENABLE_WRITE=true and pass confirm exactly as the configured confirmation phrase. |
| fortigate_update_addressA | Safely update a firewall address object. Reads the current object first and defaults to dry_run=true. |
| fortigate_delete_addressA | Safely delete a firewall address object. Reads the current object first and defaults to dry_run=true. |
| fortigate_create_address_groupA | Safely create a firewall address group with explicit members. Defaults to dry_run=true. |
| fortigate_update_address_group_membersA | Safely add, remove, or replace address group members. Reads current members first and defaults to dry_run=true. |
| fortigate_delete_address_groupA | Safely delete a firewall address group. Reads the current object first and defaults to dry_run=true. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Each tool has a clear, distinct purpose targeting specific resources (address, address group, policy, service, web filter profile, system status). No overlapping functionality; get and list are appropriately separated.
All tools follow the consistent pattern 'fortigate_verb_noun' with lowercase and underscores. Verbs are uniform: create, delete, get, list, update. No mixing of conventions.
18 tools is slightly above the typical 3-15 range but still well-scoped for managing a FortiGate firewall. Each tool serves a necessary function without redundancy.
Covers CRUD for addresses and address groups, and list/get for policies, services, and web filter profiles. Notable gaps: missing delete for policies, and no create/update/delete for services and web filter profiles.