# Antikor NGFW MCP Server

Model Context Protocol (MCP) Server for the Antikor NGFW (Next Generation Firewall) API. This server dynamically loads the API schema and exposes eligible endpoints as MCP tools for use by Claude Desktop, Cline, Cursor, Kiro, Google Antigravity, and other MCP clients.

> [!WARNING]
> **Security Notice & Disclaimer**
> - **Read/Write Endpoint Exposure:** This MCP server exposes both read and write endpoints of the Antikor NGFW API. Misconfiguration or unintended actions can lead to configuration damage, unauthorized modification of firewall policies, and potential Denial of Service (DoS). Use with caution and apply the principle of least privilege to the API credentials.
> - **Sensitive Data Masking:** The server automatically masks sensitive fields in API requests, responses, and error logs. Fields containing sensitive keywords (including `password`, `parola`, `token`, `jeton`, `secret`, and `key`) are recursively replaced with `[MASKED]` to prevent exposing credentials to the LLM or client logs.

## Configuration

Create a `.env` file in the root directory:

```env
MCP_API_BASE_URL=https://<your-firewall-ip-or-domain>:<port>
X_API_USERNAME=<your-api-username>
X_API_TOKEN=<your-api-token>
API_REJECT_UNAUTHORIZED=false
MCP_API_TIMEOUT=2000
```

- `MCP_API_BASE_URL`: The base URL of the Antikor NGFW instance.
- `X_API_USERNAME`: The username for API authentication.
- `X_API_TOKEN`: The token for API authentication.
- `API_REJECT_UNAUTHORIZED`: Set to `false` to ignore self-signed SSL/TLS certificate warnings (common in local NGFW deployments).
- `MCP_API_TIMEOUT`: Maximum duration (in ms) for API requests before timing out (default: 2000).

## Permissions & Authorization

The authorization of the MCP tools depends entirely on the service account credentials provided via `X_API_USERNAME` and `X_API_TOKEN`.

- **Service Account Requirement:** Only **Antikor NGFW Service Accounts** (not standard user accounts) can be used with this MCP server.
- **Access Control Configuration:** All permissions and authorizations must be configured directly on the **Antikor NGFW** admin interface for this service account user. The MCP client will only be able to execute tools (read or write) that the service account has explicit permission to access. It is highly recommended to follow the principle of least privilege.

## Client Integration Examples

### 1. Claude Desktop
Add the server to your `claude_desktop_config.json` file (usually located at `~/.config/Claude/claude_desktop_config.json` or `~/Library/Application Support/Claude/claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "antikor-ngfw": {
      "command": "node",
      "args": ["<absolute-path-to-project>/index.js"],
      "env": {
        "MCP_API_BASE_URL": "https://<your-firewall-ip-or-domain>:<port>",
        "X_API_USERNAME": "<your-api-username>",
        "X_API_TOKEN": "<your-api-token>",
        "API_REJECT_UNAUTHORIZED": "false",
        "MCP_API_TIMEOUT": "2000"
      }
    }
  }
}
```

### 2. Cursor (Codex)
Configure the MCP server under **Cursor Settings** > **Features** > **MCP**:
- **Name**: `antikor-ngfw`
- **Type**: `command`
- **Command**: `node <absolute-path-to-project>/index.js`

### 3. Cline (VS Code Extension)
Add the configuration to the Cline MCP settings file (usually at `~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json`):

```json
{
  "mcpServers": {
    "antikor-ngfw": {
      "command": "node",
      "args": ["<absolute-path-to-project>/index.js"],
      "env": {
        "MCP_API_BASE_URL": "https://<your-firewall-ip-or-domain>:<port>",
        "X_API_USERNAME": "<your-api-username>",
        "X_API_TOKEN": "<your-api-token>",
        "API_REJECT_UNAUTHORIZED": "false",
        "MCP_API_TIMEOUT": "2000"
      }
    }
  }
}
```

### 4. Kiro IDE
Add the server to your Kiro configuration file (e.g. `~/.kiro/mcp_config.json` or `.kiro/config.json`):

```json
{
  "mcpServers": {
    "antikor-ngfw": {
      "command": "node",
      "args": ["<absolute-path-to-project>/index.js"],
      "env": {
        "MCP_API_BASE_URL": "https://<your-firewall-ip-or-domain>:<port>",
        "X_API_USERNAME": "<your-api-username>",
        "X_API_TOKEN": "<your-api-token>",
        "API_REJECT_UNAUTHORIZED": "false",
        "MCP_API_TIMEOUT": "2000"
      }
    }
  }
}
```

### 5. Antigravity IDE (Google / Advanced Agentic Coding)
Add the server configuration to your user-level or project-level MCP settings file (typically `~/.gemini/config/mcp_config.json`):

```json
{
  "mcpServers": {
    "antikor-ngfw": {
      "command": "node",
      "args": ["<absolute-path-to-project>/index.js"],
      "env": {
        "MCP_API_BASE_URL": "https://<your-firewall-ip-or-domain>:<port>",
        "X_API_USERNAME": "<your-api-username>",
        "X_API_TOKEN": "<your-api-token>",
        "API_REJECT_UNAUTHORIZED": "false",
        "MCP_API_TIMEOUT": "2000"
      }
    }
  }
}