firewalla-mcp-server

Retrieve current security alerts and alarms from Firewalla firewall

Get detailed information for a specific Firewalla alarm

Query network traffic flows from Firewalla firewall

Check online/offline status of devices on Firewalla network

Retrieve firewall rules and conditions

Temporarily disable an active firewall rule for a specified duration

Resume a previously paused firewall rule, restoring it to active state

Retrieve all target lists from Firewalla

Retrieve a specific target list by ID

Create a new target list

Update an existing target list

Delete a target list

Search network flows with advanced query filters. Use this for: historical analysis, specific time ranges, complex filtering, or when you need more than 50 flows. Supports pagination, time-based queries (e.g., "ts:>1h" for last hour), and all flow fields including geographic filtering. For quick "what's happening now" snapshots, use get_recent_flow_activity instead.

Search alarms using full-text or field filters. Alarm types: 1=Security Activity, 2=Abnormal Upload, 3=Large Bandwidth Usage, 4=Monthly Data Plan, 5=New Device, 6=Device Back Online, 7=Device Offline, 8=Video Activity, 9=Gaming Activity, 10=Porn Activity, 11=VPN Activity, 12=VPN Connection Restored, 13=VPN Connection Error, 14=Open Port, 15=Internet Connectivity Update, 16=Large Upload.

Search firewall rules by target, action or status. Supports all rule fields.

Retrieve list of Firewalla boxes

Retrieve basic statistics overview

Retrieve statistics by region (top regions by blocked flows)

Get statistics for each Firewalla box (top boxes by blocked flows or security alarms)

Get recent network flow activity snapshot (last 10-20 minutes). Returns up to 50 most recent flows for immediate analysis. CRITICAL: This is a quick snapshot tool only. Use this for: "what's happening right now?", current security threats, immediate network issues. DO NOT use for: historical analysis (use search_flows), getting more than 50 flows (use search_flows with limit), daily/weekly patterns (use search_flows with time queries like "ts:>24h"). For comprehensive analysis, always prefer search_flows.

Get category-based flow analysis including top content categories, bandwidth consumers, and blocked traffic. Ideal for answering questions like "what porn sites were accessed" or "what social media was used". Replaces time-based trends with actionable insights.

Get historical alarm trend data (alarms generated per day)

Get historical rule trend data (rules created per day)

Get top bandwidth consuming devices (convenience wrapper around get_device_status)

Get all offline devices (convenience wrapper around get_device_status)

Search devices by name, IP, MAC or status (convenience wrapper with client-side filtering)

Search target lists with client-side filtering (convenience wrapper around get_target_lists)

Get overview statistics and counts of network rules by category (convenience wrapper)