fortinac-mcp

Code generated by AI (vibe-coded) / Code entirely generated by AI

MCP server for diagnosing rogue hosts on FortiNAC 7.6.

Queries the FortiNAC REST API, cross-references each device against the profiling rules, and runs nmap scans to precisely identify which conditions are blocking classification.

Prerequisites

• Python 3.10+

• nmap (brew install nmap)

• A FortiNAC API token with read access to hosts and profiling rules

Related MCP server: MCP Network Tools

Installation

cd fortinac-mcp
python3 -m venv .venv
.venv/bin/pip install -e .

Configuration

Add to ~/.mcp.json:

{
  "fortinac": {
    "type": "stdio",
    "command": "/chemin/vers/fortinac-mcp/.venv/bin/python",
    "args": ["-m", "fortinac_mcp"],
    "env": {
      "FORTINAC_URL": "https://fortinac.example.com",
      "FORTINAC_TOKEN": "votre-token-api",
      "FORTINAC_VERIFY_SSL": "false"
    }
  }
}

Restart Claude Code to load the server.

Tools

• check_status -- checks the API connection and nmap availability

• list_rogues -- lists rogue hosts (MAC, IP, vendor, VLAN)

• diagnose_rogues -- batch diagnosis: tests each rogue against all profiling rules

• diagnose_host -- diagnosis of a host by MAC address

• scan_host -- nmap scan on an IP (ports, services, OS)

• lookup_vendor -- looks up the manufacturer from a MAC address

• get_profiling_rules -- exports profiling rules from FortiNAC

• get_host_details -- full details of a host

• reprofile_all_rogues -- re-runs rogue evaluation on the FortiNAC side

Diagnostics

For each rogue, diagnose_rogues checks:

• Vendor OUI (MAC match / expected manufacturer)

• Open ports via nmap (vs ports required by the rule)

• DHCP fingerprint (presence and match)

• SNMP OID (response and expected value)

• IP range (correct subnet)

• Location (network placement)

The report indicates the conditions that pass, those that fail, and suggests corrective actions.