WatchGuard Cloud MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AUTH_MODE | No | env (default, reads the vars above) or gateway (credentials arrive per-request via X-WatchGuardCloud-* headers, injected by the Conduit gateway). | env |
| LOG_LEVEL | No | debug | info (default) | warn | error. | info |
| MCP_TRANSPORT | No | stdio (default) or http. | stdio |
| CONDUIT_S2S_SECRET | No | When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request. | |
| WATCHGUARDCLOUD_REGION | No | usa (default), deu (EMEA), or jpn (APAC) - your account's data-storage region. | usa |
| WATCHGUARDCLOUD_API_KEY | No | WatchGuard-API-Key generated when API access is enabled. | |
| WATCHGUARDCLOUD_PASSWORD | No | Password paired with the AccessID. | |
| WATCHGUARDCLOUD_ACCESS_ID | No | AccessID from WatchGuard Cloud API Access. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| watchguardcloud_get_accountA | Get a WatchGuard Cloud account by ID, optionally expanded with contacts/addresses/service properties. |
| watchguardcloud_create_accountB | Create a new managed (child) account under a parent WatchGuard Cloud account. |
| watchguardcloud_update_accountB | Update a managed account's name and primary contact. |
| watchguardcloud_delete_accountA | Delete a managed WatchGuard Cloud account. Set force to also delete its child accounts. |
| watchguardcloud_list_managed_accountsB | List accounts managed by (delegated from) a WatchGuard Cloud account, with paging/sorting/filtering. |
| watchguardcloud_create_activationB | Activate one or more Firebox/hardware devices or SaaS licenses by activation key. |
| watchguardcloud_list_recent_activationsB | List activation batches submitted in roughly the last 30 days for the account. |
| watchguardcloud_get_activation_statusB | Get per-line-item status for an activation batch by batch ID. |
| watchguardcloud_create_operatorB | Create a WatchGuard Cloud operator (user) account with an assigned privilege role. Role options depend on whether the account is a Service Provider (OWNER, SALES, HELPDESK, AUDITOR, NO_ACCESS) or a Subscriber (ADMINISTRATOR, ANALYST, OBSERVER, NO_ACCESS). |
| watchguardcloud_update_operatorB | Update an existing WatchGuard Cloud operator's name, phone, or privilege role. |
| watchguardcloud_delete_operatorB | Delete a WatchGuard Cloud operator (user) account. |
| watchguardcloud_get_operator_transaction_statusA | Poll the async result of a prior create/update/delete operator call by transaction ID. |
| watchguardcloud_list_operatorsA | List every operator (user) account and its role/MFA status for a WatchGuard Cloud account. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 13 tools
Each tool targets a clear resource-action combination: accounts, activations, or operators. Even the two status tools are distinguishable by batch/transaction context. There is no meaningful overlap between tool purposes.
All tools follow the consistent watchguardcloud_ verb_noun pattern. Verbs are get, create, update, delete, list, which map predictably to the resource nouns. This makes the toolset easy to navigate.
13 tools is well-scoped for a cloud management server covering accounts, activations, and operators. Each tool handles a distinct operation, and none feel redundant or unnecessary. The count supports the domain without becoming unwieldy.
The toolset covers the main lifecycle operations for accounts, activations, and operators: create, read, update, delete, and list where applicable. Async operator operations are supported via transaction status polling, closing an important workflow gap. The domain appears thoroughly covered for its stated purpose.