fortigate-mcp

An MCP (Model Context Protocol) server for managing and monitoring FortiGate firewalls through the FortiOS REST API.

Connect your AI assistant (Claude Code, Claude Desktop, or any MCP client) to one or more FortiGates and ask things like:

"Which firewall policies have never been hit?" "Is the IPsec tunnel to the branch office up?" "Show me all active sessions from 10.0.0.15."

Initial setup (creating the API user and token on the FortiGate) is automated over SSH — after that, everything runs over the REST API with a token. SSH credentials are never stored.

Features

Phase 1 — read-only (current):

Roadmap:

• Phase 2 — guarded write operations (create/update policies and objects, block an IP) with a read_only kill-switch and dry-run support

• Phase 3 — analysis tools (unused policies, shadowed rules, config audit)

• Optional SSH transport for diagnose/execute commands not exposed by REST

Related MCP server: FortiGate MCP Server

FortiOS version support

Primary target is FortiOS 7.0 – 7.6, with best-effort support for 6.4. Versions below 6.4 are rejected (end-of-life). The device version is detected automatically from API responses; per-version differences live in one place (src/fortigate_mcp/quirks.py).

Quick start

# 1. Install (Python 3.10+)
git clone https://github.com/irfanharis/fortigate-mcp.git
cd fortigate-mcp
python -m venv .venv
.venv/Scripts/activate          # Windows  (Linux/macOS: source .venv/bin/activate)
pip install -e .

# 2. Bootstrap your FortiGate (creates the API user over SSH, one time)
fortigate-mcp-bootstrap --host 192.168.1.99 --ssh-user admin \
    --trusthost 192.168.1.50 --name lab

# 3. Register with your MCP client, e.g. Claude Code
claude mcp add fortigate -- fortigate-mcp

See the Usage Guide for full documentation: manual setup without SSH, multi-device and multi-VDOM configuration, per-tool examples, and troubleshooting.

Security model

• Read-only by default, at two layers: the access profile created on the FortiGate only grants read, and the MCP config has read_only: true (used to reject write tools in Phase 2). Pass --read-write to bootstrap only when you need write access.

• Trusthost pinning: with --trusthost, the token only works from the machine running the MCP server.

• No stored SSH credentials: SSH is used once for bootstrap; only the API token is persisted, in a config file that is git-ignored.

License

MIT — see LICENSE.