This server lets AI assistants inspect, diagnose, and manage Palo Alto Networks PAN-OS firewalls and Panorama through natural-language MCP tool calls.
Read firewall state: system info, HA status, active sessions, resources, interfaces, zones, routing/ARP tables, VLANs, DHCP leases, DNS proxy, and static routes.
Manage security: list/search/test security rules, PBF/decryption/QoS/DoS rules, and security profiles/profile groups.
Work with objects: address/service objects and groups, application filters, tags, and custom URL categories.
Manage NAT rules: get, add, move, delete, enable/disable.
User-ID and access: IP-user mappings, user groups, User-ID config, and GlobalProtect connected users.
Admin and certificates: admins, admin roles, auth profiles, certificates, and decryption rules/profiles.
Panorama: managed devices, device groups, templates/stacks, shared objects/profiles, pre/post rules, device-group NAT, push/commit status, HA, and log collectors.
Logs and threat: search traffic, threat, system, URL, and config logs; WildFire status; antivirus/content versions; URL categories; and EDL lookups.
Diagnose issues: start ticket diagnosis, diagnose user blocks, URL access, threat/file blocks, and flows; test security policy matches and URL categories; show sessions.
Make changes: set/delete configuration via XPath, commit, and Panorama commit/push.
Run arbitrary read-only op commands (show/test) and XPath config reads for anything not covered by dedicated tools.
Multi-firewall support: register multiple firewalls/Panoramas and target the right device, device group, or Panorama entry.
Provides tools for managing Palo Alto Networks PAN-OS firewalls and Panorama, including security policies, objects, NAT rules, VPNs, logs, certificates, and configuration commits via the PAN-OS XML API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PanOS MCP Server List all security rules allowing traffic from external to DMZ."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Control your Palo Alto Networks firewall with AI. PanOS MCP is an MCP (Model Context Protocol) server that connects AI assistants — Claude, Cursor, and others — directly to PAN-OS firewalls and Panorama via the PAN-OS XML API. Ask questions, inspect policies, and make configuration changes in plain English instead of navigating the GUI or writing API scripts.
Supports PA-Series firewalls (PA-220, PA-415, PA-440, PA-445, PA-450, PA-460, PA-1400, PA-3400, PA-5400, PA-7500 and more), VM-Series, CN-Series, and Panorama — any device running PAN-OS with API access enabled.
Warning: This server gives an AI model direct access to your firewall configuration via the PanOS API. AI models can make mistakes, misinterpret instructions, or take unintended actions that may disrupt network traffic, modify security policies, or cause outages. Use at your own risk. Always review AI-proposed changes before committing, use a read-only API key where possible, and never run against production firewalls without understanding the consequences.
117 tools across 16 modules covering firewall management, monitoring, and configuration changes — all from within your AI assistant.
Talk to your firewall in plain English. Some examples:
"Show me all security rules that allow traffic from the internet to the DMZ"
"Which GlobalProtect users are currently connected?"
"Create an address object for 10.10.0.0/24 called corp-network and add it to the allow-internal group"
"Check HA status — is the standby firewall in sync?"
"Show me the last 50 threat log entries"
"Move the block-social-media rule above the allow-web rule and commit"
"List all IPSec tunnels and their current state"
"What software version is running on each managed device in Panorama?"
Related MCP server: Palo Alto Device Server
Read-only inspection of firewall state, policies, objects, logs, and more
Configuration management via XPath-based set/delete with staged commits
Panorama support for centralized management of device groups, templates, and shared objects
Multi-firewall mode — manage multiple PA-Series devices or Panorama instances simultaneously
Secure credential storage — API keys stored in the OS keychain, never in plaintext
Input validation with Zod schemas for early error detection
Safety labels on every tool: [READ-ONLY], [MODIFIES CONFIG], or [ADVANCED]
Node.js 22.19+
A PanOS firewall or Panorama appliance with API access enabled
A PanOS API key (how to generate)
To generate a PanOS API key directly from a firewall, use the XML API keygen endpoint:
curl -k -X GET 'https://<FIREWALL_IP_OR_HOST>/api/?type=keygen&user=<USERNAME>&password=<PASSWORD>'This sends credentials in the request URL and skips TLS certificate verification. Use it only from a trusted management network, and prefer a scoped or read-only API key where possible.
Single firewall vs. multi-firewall: The Desktop Extension supports one firewall configured at install time. For managing multiple firewalls or Panorama instances simultaneously, use the npx or Claude Code CLI installation with the
panos-keygensetup described in Multiple firewalls.
Download the latest panos-mcp.mcpb from Releases
Double-click the file — Claude Desktop opens an install dialog
Enter your Firewall Host and API Key when prompted
The API key is stored securely in your OS keychain, not in plaintext config files.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"panos": {
"command": "npx",
"args": ["-y", "github:apius-tech/Palo-MCP"],
"env": {
"PANOS_HOST": "your-firewall-or-panorama",
"PANOS_API_KEY": "your-api-key"
}
}
}
}Config file location: macOS ~/Library/Application Support/Claude/claude_desktop_config.json · Windows %APPDATA%\Claude\claude_desktop_config.json
claude mcp add panos -- npx -y github:apius-tech/Palo-MCP \
--env PANOS_HOST=your-firewall-or-panorama \
--env PANOS_API_KEY=your-api-keyOpen Cursor Settings (Ctrl+Shift+J) → MCP → Add new MCP server, or add to ~/.cursor/mcp.json:
{
"mcpServers": {
"panos": {
"command": "npx",
"args": ["-y", "github:apius-tech/Palo-MCP"],
"env": {
"PANOS_HOST": "your-firewall-or-panorama",
"PANOS_API_KEY": "your-api-key"
}
}
}
}Replace your-firewall-or-panorama with your firewall/Panorama IP or hostname, and your-api-key with your PanOS API key.
For managing more than one firewall or Panorama, use the panos-keygen CLI to register each one. It generates an API key, stores it in your OS keychain, and writes the host entry to ~/.config/panos-mcp/firewalls.json:
npx panos-keygen --host fw-hq.example.com --user admin --name hq-fw
npx panos-keygen --host fw-branch.example.com --user admin --name branch-fw
npx panos-keygen --host panorama.example.com --user admin --name panoramaYou will be prompted for the password. The API key is stored in the OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) — never in the JSON file.
If you already have API keys, you can write them directly to firewalls.json with api_key fields — they will be auto-migrated to the keychain on the next server startup:
{
"firewalls": [
{ "name": "hq-fw", "host": "fw-hq.example.com", "api_key": "LUFRPT1..." },
{ "name": "panorama", "host": "panorama.example.com", "api_key": "LUFRPT2..." }
]
}Override the config path with PANOS_FIREWALLS_CONFIG=/custom/path.json if needed. name is the identifier you pass to tools (max 63 chars); host may include or omit the https:// prefix.
When multiple entries are configured, every tool accepts a firewall: <name> parameter — required in multi-mode, optional when a single entry or PANOS_HOST/PANOS_API_KEY env vars are used. Ask the model to call list_firewalls to see which targets are configured.
Linux headless servers: If no keychain daemon is available (e.g. servers without
libsecret), API keys fall back to plaintext infirewalls.jsonwith a warning. Restrict the file withchmod 600 ~/.config/panos-mcp/firewalls.jsonin that case.
Conventions that the configuration does not show (which device group serves which traffic, where exception rules go, which AD group is which team) can be written in a local Markdown file, kept outside the repository:
~/.config/panorama-mcp/org-notes.mdOverride the path with PANOS_ORG_NOTES=/custom/path.md. The notes are appended to the server instructions, start_ticket_diagnosis, the playbook and the diagnose_ticket prompt. They are re-read on every call (server instructions only at startup). Example:
- DG-Users-Rules: traffic of regular users. DG-VDI-Rules: traffic from VDI sessions.
Put a user's exception in the device group matching where they connect from.MCP clients drop a request after about 60 seconds (GitHub Copilot CLI included). Each tool call therefore has a time budget (PANOS_TOOL_BUDGET_SECONDS, default 50): log jobs are stopped before it runs out and the backward log search returns what it found with a lookback_start_days value to resume. Client cancellations stop the running log jobs on Panorama.
Config reads are cached for PANOS_CONFIG_CACHE_SECONDS (default 300, 0 disables), since a diagnosis reads the rules and objects of every device group several times. PANOS_LOG_TIMEOUT (default 120) still caps a single log job.
Category | Tools | Description |
System | 4 | Firewall info, HA status, sessions, resources |
Network | 10 | Interfaces, zones, routing, ARP, VLANs, DHCP, DNS proxy, static routes (get, add, delete) |
Security | 18 | Security rules CRUD, profiles, profile groups, PBF rules CRUD, DoS, QoS rules CRUD |
Objects | 16 | Address/service objects and groups (get, add, delete), application filters, tags (get, add, delete) |
NAT | 5 | NAT rules (get, add, move, delete, enable/disable) |
User-ID | 3 | User-IP mappings, groups, config |
Admin | 3 | Admins, roles, auth profiles |
VPN | 3 | IPSec tunnels, GlobalProtect users and config |
Panorama | 29 | Device groups, templates, shared objects, pre/post rules CRUD, DG NAT rules CRUD, push status, HA |
Logs | 5 | Traffic, threat, system, URL, and config logs |
Threat | 4 | WildFire, antivirus, content versions, URL categories |
Certificates | 7 | Certificates, decryption rules (get, add, move, delete, enable/disable) and profiles |
Licenses | 2 | License info and usage |
Config | 5 | Set/delete config, commit, Panorama commit, Panorama push |
Utility | 2 | Arbitrary op commands, XPath config reads |
Firewalls | 1 | List configured firewall targets |
Every tool is labeled to indicate its impact:
[READ-ONLY] — Only reads data; no changes to the firewall
[MODIFIES CONFIG] — Stages or commits configuration changes that affect live traffic
[ADVANCED] — Accepts arbitrary commands; impact depends on the input
Generate a PanOS API key from the firewall web UI or CLI:
Web UI: Device → Administrators → your admin user → Generate API Key
CLI:
curl -k 'https://YOUR-FIREWALL/api/?type=keygen&user=admin&password=YOUR-PASSWORD'See PanOS documentation for details.
If your firewall is reachable only via a proxy (management network behind a jump host, remote access via SOCKS5, corporate HTTP proxy), set one of the following environment variables before starting the server:
Variable | Purpose |
| Explicit override. Used regardless of |
| Standard — same semantics as most HTTP clients. |
| Fallback. |
| Fallback (common for SOCKS). |
| Comma-separated list of hostnames/suffixes to bypass. |
Supported URL schemes:
http://[user:pass@]host:port — HTTP CONNECT proxy
https://[user:pass@]host:port — HTTPS CONNECT proxy
socks5://[user:pass@]host:port — SOCKS5, client-side DNS
socks5h://[user:pass@]host:port — SOCKS5, proxy-side DNS (use this when the firewall hostname only resolves on the far side of the proxy)
socks4://[user@]host:port / socks4a://[user@]host:port
Example — SOCKS5 with remote DNS:
export PANOS_PROXY=socks5h://10.0.1.168:2080Self-signed firewall certificates are accepted through the proxy tunnel (the server already disables cert validation for the PanOS target).
git clone https://github.com/apius-tech/Palo-MCP.git
cd Palo-MCP
npm install
cp .env.example .env # fill in PANOS_HOST and PANOS_API_KEYnpm run build # compile TypeScript
npm run dev # watch mode (rebuild on changes)
npm test # run tests
npm run start # run the server
npm run pack:extension # build Desktop Extension (.mcpb)"Show me the firewall system info"
Uses get_firewall_info to retrieve hostname, model, serial number, and software version.
"List all security rules on the firewall"
Uses get_security_rules to retrieve the full security policy rulebase.
"Create an address object for the 10.0.1.0/24 subnet called lab-network, then commit"
Uses set_config to create the address object in the candidate configuration, then commit to activate the change on the running firewall.
No data collection — This extension does not collect, store, or transmit any data to third parties.
Direct communication only — All API calls go directly from your machine to your PanOS firewall or Panorama. No traffic is routed through intermediary servers.
Local credential storage — API keys are stored in your OS keychain (Desktop Extension and multi-firewall mode via panos-keygen), or in local environment variables. They are never sent anywhere other than your firewall.
No telemetry or analytics — This extension contains no tracking, telemetry, or analytics of any kind.
Data retention — No data is retained by the extension or its authors. Firewall responses exist only transiently in memory to serve the active request and are not persisted, logged, or shared. The only data stored at rest is your API key, kept locally in your OS keychain or environment variables under your control.
Third-party sharing — None. No data is shared with the authors, Anthropic, or any third party beyond the direct connection to your own firewall.
Contact — For privacy questions or data requests, open a GitHub issue. Maintained by Apius Technologies SA.
This software is provided "as is", without warranty of any kind. This tool connects an AI model to live network infrastructure. AI models can hallucinate, misunderstand context, and execute unintended changes. The authors are not responsible for any damage, data loss, outages, or security incidents caused by the use of this software. You are solely responsible for any actions taken by the AI model through this server.
Recommendations:
Test in a lab environment before using in production
Use a read-only API key for inspection tasks
Always review and confirm changes before committing
Monitor firewall logs for unexpected configuration changes
Please do not open a public GitHub issue for security vulnerabilities. See SECURITY.md for private reporting via GitHub Private Vulnerability Reporting or email.
MIT
[READ-ONLY] Analyzes a flow (source -> destination:port) on a firewall: User-ID mapping and groups of the source, rule the firewall actually matches (test security-policy-match with the user), rules allowing the requested application, and recent traffic logs explained. Use for 'no rule allows X', upload app functions, App-ID or network issues.
Inputs: destination (required), destination_port (required), user, device, +6 more.
[READ-ONLY] Analyzes a threat/file block (antivirus, WildFire, anti-spyware, vulnerability, file blocking, data filtering): finds the log, the rule and the security profile actually applied (profile group resolved), whether an exception for that threat ID ALREADY exists (in the applied profile or elsewhere), the matching file-blocking rule, and the WildFire verdict.
Inputs: user, period, src_ip, filename, +4 more.
[READ-ONLY] Full analysis of why a URL is blocked/allowed: existing custom categories covering it (or same-domain entries that do not match), PAN-DB category, rules and URL filtering profiles using those categories, recent URL logs for the user, and conclusions. Prevents proposing a category that already exists.
Inputs: url (required), user, device, period, +3 more.
[READ-ONLY] START HERE for a ticket. Builds a timeline of everything that blocked a user or source IP across traffic, threat, URL, WildFire, data filtering, decryption and GlobalProtect logs, grouped and explained (which layer blocked, why, what to check next). With reported_url, flags blocks on OTHER domains at the same time (upload/storage/CDN/SSO dependencies of the site).
Inputs: user, period, src_ip, firewall, +3 more.
[READ-ONLY] Checks whether an IP, domain or URL is present in the External Dynamic Lists applying to a firewall (config from Panorama, current content from the firewall), including EDL exception lists.
Inputs: value (required), name, device, firewall, +1 more.
[READ-ONLY] Searches security or decryption rules (pre/post) in Panorama's running config. Matches 'contains' against rule name, zones, addresses, users, applications, services, categories, tags and description. With 'device_group', rules of that group AND everything it inherits (shared, parent groups) are returned in evaluation order; with 'device', only rules applying to that firewall. Output flags rules without log forwarding.
Inputs: device, policy, contains, firewall, +3 more.
[READ-ONLY] Retrieves active session count and summary from the firewall. Executes: show session info.
Inputs: firewall.
[READ-ONLY] Retrieves all address groups that contain multiple address objects. Reads config at: /config/.../vsys/entry/address-group.
Inputs: firewall.
[READ-ONLY] Retrieves all address objects (IP addresses, ranges, FQDNs) defined on the firewall. Reads config at: /config/.../vsys/entry/address.
Inputs: firewall.
[READ-ONLY] Retrieves administrator role definitions and their permissions. Reads config at: /config/.../vsys/entry/admin-role.
Inputs: firewall.
[READ-ONLY] Retrieves all administrator accounts configured on the firewall. Reads config at: /config/mgt-config/users.
Inputs: firewall.
[READ-ONLY] Retrieves current antivirus, threat, and WildFire signature versions and release dates. Executes: show system info (extracts signature fields).
Inputs: firewall.
[READ-ONLY] Retrieves application filters used for application-based policy rules. Reads config at: /config/.../vsys/entry/application-filter.
Inputs: firewall.
[READ-ONLY] Retrieves ARP table entries from the firewall. Executes: show arp entry all.
Inputs: firewall.
[READ-ONLY] Retrieves authentication profiles including RADIUS, LDAP, and TACACS+ configurations. Reads config at: /config/shared/authentication-profile.
Inputs: firewall.
[READ-ONLY] Retrieves SSL/TLS certificates configured on the firewall. Reads config at: /config/shared/certificate.
Inputs: firewall.
[READ-ONLY] Retrieves recent configuration change logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.
Inputs: nlogs, query, firewall.
[READ-ONLY] Retrieves configuration at a specific XPath location. This is a flexible read tool for querying any part of the PanOS configuration tree.
Inputs: xpath (required), firewall.
[READ-ONLY] Retrieves available content update versions (antivirus, applications, threats). Executes: request content upgrade info.
Inputs: firewall.
[READ-ONLY] Retrieves SSL decryption profiles. Reads config at: /config/.../profiles/decryption.
Inputs: firewall.
[READ-ONLY] Retrieves SSL decryption policy rules. Reads config at: /config/.../rulebase/decryption/rules.
Inputs: firewall.
[READ-ONLY] Retrieves DHCP server lease information. Executes: show dhcp server lease all.
Inputs: firewall.
[READ-ONLY] Retrieves DNS proxy configuration. Reads config at: /config/.../network/dns-proxy.
Inputs: firewall.
[READ-ONLY] Retrieves DoS protection profiles. Reads config at: /config/.../profiles/dos-protection.
Inputs: firewall.
[READ-ONLY] Retrieves system information (hostname, model, serial, software version) from the PanOS firewall. Executes: show system info.
Inputs: firewall.
[READ-ONLY] Retrieves GlobalProtect gateway and portal configuration. Reads config at: /config/.../vsys/entry/global-protect.
Inputs: firewall.
[READ-ONLY] Retrieves currently connected GlobalProtect VPN users. Executes: show global-protect-gateway current-user.
Inputs: firewall.
[READ-ONLY] Retrieves high-availability (HA) state and peer information from the firewall. Executes: show high-availability state.
Inputs: firewall.
[READ-ONLY] Retrieves all network interfaces with their status, IP addresses, and configuration. Executes: show interface all.
Inputs: firewall.
[READ-ONLY] Retrieves IPSec VPN tunnel status and security associations. Executes: show vpn ipsec-sa.
Inputs: firewall.
[READ-ONLY] Retrieves license status and expiration dates for all features. Executes: request license info.
Inputs: firewall.
[READ-ONLY] Retrieves license usage information including VM model, serial, capacity tier, and mode. Executes: show system info (extracts license fields).
Inputs: firewall.
[READ-ONLY] Retrieves all NAT policy rules including source NAT, destination NAT, and bidirectional rules. Reads config at: /config/.../rulebase/nat/rules.
Inputs: firewall.
[READ-ONLY] Retrieves policy-based forwarding (PBF) rules. Reads config at: /config/.../rulebase/pbf/rules.
Inputs: firewall.
[READ-ONLY] Retrieves QoS policy rules. Reads config at: /config/.../rulebase/qos/rules.
Inputs: firewall.
[READ-ONLY] Retrieves the current routing table from the firewall. Executes: show routing route.
Inputs: firewall.
[READ-ONLY] Retrieves security profile groups that combine multiple security profiles. Reads config at: /config/.../vsys/entry/profile-group.
Inputs: firewall.
[READ-ONLY] Retrieves security profiles including antivirus, vulnerability, spyware, and URL filtering profiles. Reads config at: /config/.../vsys/entry/profiles.
Inputs: firewall.
[READ-ONLY] Retrieves all security policy rules from the firewall. Reads config at: /config/.../rulebase/security/rules.
Inputs: firewall.
[READ-ONLY] Retrieves all service groups that contain multiple service objects. Reads config at: /config/.../vsys/entry/service-group.
Inputs: firewall.
[READ-ONLY] Retrieves all service objects (port/protocol definitions) from the firewall. Reads config at: /config/.../vsys/entry/service.
Inputs: firewall.
[READ-ONLY] Retrieves static routes from a virtual router. Reads config at: /config/.../virtual-router/entry/routing-table/ip/static-route.
Inputs: firewall, virtual_router.
[READ-ONLY] Retrieves recent system logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.
Inputs: nlogs, query, firewall.
[READ-ONLY] Retrieves system resource utilization including CPU, memory, and disk usage. Executes: show system resources.
Inputs: firewall.
[READ-ONLY] Retrieves all tags defined on the firewall. Reads config at: /config/.../vsys/entry/tag.
Inputs: firewall.
[READ-ONLY] Retrieves recent threat logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.
Inputs: nlogs, query, firewall.
[READ-ONLY] Retrieves recent traffic logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.
Inputs: nlogs, query, firewall.
[READ-ONLY] Returns the troubleshooting playbook: visibility pitfalls, third-party dependencies, URL filtering, file/threat false positives, App-ID, User-ID, NAT, decryption, DNS security, EDL, zone protection. Read it when the cause is unclear or before concluding.
Inputs: no named parameters.
[READ-ONLY] Retrieves predefined URL filtering categories. Reads config at: /config/predefined/pan-url-categories.
Inputs: firewall.
[READ-ONLY] Retrieves recent URL filtering logs from the firewall using the PanOS log API (type=log&log-type=url). Shows URLs visited and actions taken (allow/block/continue/override) by URL filtering policy.
Inputs: nlogs, query, firewall.
[READ-ONLY] Retrieves User-ID configuration settings including agent configuration and group mapping. Reads config at: /config/.../vsys/entry/user-id-agent.
Inputs: firewall.
[READ-ONLY] Retrieves user groups known to the firewall via User-ID. Executes: show user group list.
Inputs: firewall.
[READ-ONLY] Retrieves IP-to-user mappings from User-ID, showing which users are mapped to which IP addresses. Executes: show user ip-user-mapping all.
Inputs: firewall.
[READ-ONLY] Retrieves VLAN configuration from the firewall. Reads config at: /config/.../network/vlan.
Inputs: firewall.
[READ-ONLY] Retrieves WildFire cloud connection status and statistics. Executes: show wildfire status.
Inputs: firewall.
[READ-ONLY] Retrieves all security zones configured on the firewall. Reads config at: /config/.../vsys/entry/zone.
Inputs: firewall.
[READ-ONLY] GlobalProtect users currently connected to a gateway firewall (show global-protect-gateway current-user), optionally for one user.
Inputs: user, device, firewall, device_group.
[READ-ONLY] Lists all configured firewall targets. Shows names and hosts (never API keys). Indicates whether the 'firewall' parameter is required for other tools.
Inputs: no named parameters.
[READ-ONLY] Retrieves collector group configuration from Panorama. Reads config at: /config/.../log-collector-group.
Inputs: firewall.
[READ-ONLY] Retrieves the status of pending commits in Panorama. Executes: show jobs all.
Inputs: firewall.
[READ-ONLY] Retrieves the device group hierarchy showing parent-child relationships. Reads config at: /config/readonly/.../device-group.
Inputs: firewall.
[READ-ONLY] Retrieves NAT rules from a device group (pre or post rulebase). Reads config at: /config/.../device-group/entry/{pre|post}-rulebase/nat/rules.
Inputs: rulebase (required), device_group (required), firewall.
[READ-ONLY] Retrieves all device groups configured in Panorama. Reads config at: /config/.../device-group.
Inputs: firewall.
[READ-ONLY] Retrieves Panorama high-availability status for Panorama HA pairs. Executes: show high-availability state.
Inputs: firewall.
[READ-ONLY] Retrieves log collector configuration and status from Panorama. Executes: show log-collector all.
Inputs: firewall.
[READ-ONLY] Retrieves all firewalls managed by Panorama with their connection status. Executes: show devices all.
Inputs: firewall.
[READ-ONLY] Retrieves software and content versions on all managed firewalls. Executes: show devices all.
Inputs: firewall.
[READ-ONLY] Retrieves post-rules from a device group (rules pushed after local firewall rules). Reads config at: /config/.../device-group/entry/post-rulebase/security/rules.
Inputs: device_group (required), firewall.
[READ-ONLY] Retrieves pre-rules from a device group (rules pushed before local firewall rules). Reads config at: /config/.../device-group/entry/pre-rulebase/security/rules.
Inputs: device_group (required), firewall.
[READ-ONLY] Retrieves the status of the last configuration push to managed devices. Executes: show config push status.
Inputs: firewall.
[READ-ONLY] Retrieves all templates configured in Panorama. Reads config at: /config/.../template.
Inputs: firewall.
[READ-ONLY] Retrieves all template stacks configured in Panorama. Reads config at: /config/.../template-stack.
Inputs: firewall.
[READ-ONLY] Lists device groups with their parent chain and member firewalls (hostname, serial, connected). Policies of a device group include everything inherited from shared and its parents.
Inputs: refresh, firewall.
[READ-ONLY] Lists firewalls managed by Panorama: hostname, serial, IP, model, version, connection and policy/template sync state. Use the hostname or serial as 'device' in other tools.
Inputs: filter, refresh, firewall.
[READ-ONLY] Runs an arbitrary read-only operational command (root element must be or ) on Panorama, or on a managed firewall with 'device'. Use when no dedicated tool exists.
Inputs: command (required), device, firewall.
[READ-ONLY] Searches logs stored on Panorama (traffic, threat, url, wildfire, data, globalprotect, userid, auth, decryption, system) with structured filters and a time window. Returns trimmed entries, each with a '_why' explanation of what blocked it. Structured filters are server-side for traffic/threat/url/wildfire/data/decryption; for other types user and src_ip are matched locally.
Inputs: log_type (required), app, rule, user, +13 more.
[READ-ONLY] Active sessions on a managed firewall matching a filter (show session all filter). Useful while the user reproduces the issue.
Inputs: device, source, firewall, application, +4 more.
[READ-ONLY] Call this FIRST when the user shares a support ticket or asks to debug a blocked user: returns the diagnosis method, the rules to follow and the expected answer format.
Inputs: no named parameters.
[READ-ONLY] Asks a managed firewall which security rule matches a flow (test security-policy-match). This is the ground truth, including local rules invisible from Panorama. Include source_user so user/group-based rules are evaluated.
Inputs: source (required), destination (required), destination_port (required), to, +9 more.
[READ-ONLY] Asks a managed firewall how it categorizes a URL (test url): PAN-DB categories from the local cache and the cloud. Custom categories are not shown here: use url_category_find.
Inputs: url (required), device, firewall, device_group.
[READ-ONLY] Finds which existing custom URL categories already cover a URL (PAN-OS wildcard/prefix rules), which ones contain the same domain but do not match (pattern issue), and with 'device' the PAN-DB category. Run this BEFORE proposing any new URL category.
Inputs: url (required), device, firewall, device_group.
[READ-ONLY] Returns the entries of a custom URL category (URL list, or PAN-DB categories for 'Category Match'). Searches shared and every device group unless device_group is set.
Inputs: name (required), firewall, device_group.
[READ-ONLY] Lists custom URL categories (shared and device groups) with their type and number of entries. Use url_category_get for the entries.
Inputs: firewall, device_group, name_contains.
[READ-ONLY] Shows where URL categories are used: security/decryption rules referencing them (in evaluation order when 'device' is set) and URL filtering profiles acting on them, with the rules using those profiles.
Inputs: categories (required), device, firewall, device_group.
[READ-ONLY] User-ID state on a managed firewall: which user is mapped to an IP (show user ip-user-mapping) and/or which groups a user belongs to (show user user-ids match-user). A missing mapping means user/group-based rules cannot match that IP.
Inputs: ip, user, device, firewall, +1 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 91 tools
There are several overlapping tools: get_globalprotect_users and gp_current_users both return current GlobalProtect users, get_active_sessions and show_sessions both retrieve active sessions, and list_firewalls, panorama_list_firewalls, and panorama_get_managed_devices all list firewalls in slightly different scopes. Descriptions help clarify the Panorama vs direct API distinction, but the duplicates cause ambiguity.
The majority of tools follow a get_<resource> or panorama_get_<resource> pattern, which is clear and predictable. However, there are inconsistent verbs (list_firewalls vs get_firewall_info, panorama_list_firewalls vs panorama_get_managed_devices) and domain-specific names like gp_current_users, test_security_policy_match, find_security_rules, and diagnose_* that break the pattern. Overall, the names are readable and the resource is usually clear, so the inconsistency is minor.
At 91 tools, the server far exceeds the well-scoped range and is in the extreme mismatch territory. While the domain is broad, this many tools overwhelms an agent's tool selection and many could be consolidated (e.g., generic get_* patterns for similar resources). The sheer count makes the tool surface feel bloated rather than focused.
For its stated read-only monitoring and troubleshooting purpose, the coverage is exceptionally thorough: it spans firewall system/network objects, security rules, NAT, VPN, logs, User-ID, GlobalProtect, Panorama management, and diagnostic workflows. The inclusion of run_show_command and get_config_xpath as flexible fallbacks closes any remaining gaps.
Connect AI assistants to authorized Windows and macOS devices for files, commands, and management.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...
