Skip to main content
Glama
jmvigueras

FortiAppSec MCP Server

by jmvigueras
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

FortiAppSec MCP Server

MCP server for managing Fortinet FortiAppSec (WAF as a Service) via AI agents. Built with FastMCP, deployed as a container.

Tools

Tool

Description

waf_list_applications

List all WAF applications

waf_get_application

Get details of a specific WAF application

waf_create_application

Create a new WAF application

waf_delete_application

Delete a WAF application

waf_list_templates

List available WAF templates

Every tool accepts an optional appsec_api_key parameter. If not provided, the server reads from the FORTINET_APPSEC_API_KEY environment variable. Per-call parameter overrides the environment variable.

Related MCP server: FortiCNAPP MCP Server

Connect from Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "fortiappsec": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp-fortiappsec.fortidemoscloud.com/mcp"
      ]
    }
  }
}

Connect from Gemini CLI

Add to your Gemini settings (~/.gemini/settings.json):

{
  "mcpServers": {
    "fortiappsec": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp-fortiappsec.fortidemoscloud.com/mcp"
      ]
    }
  }
}

Connect from Kiro / VS Code

Add to .kiro/settings/mcp.json or equivalent:

{
  "mcpServers": {
    "fortiappsec": {
      "url": "https://mcp-fortiappsec.fortidemoscloud.com/mcp"
    }
  }
}

Test with curl

# 1. Initialize session and capture Mcp-Session-Id from headers
export SESSION_ID=$(curl -s -i -X POST https://mcp-fortiappsec.fortidemoscloud.com/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test-curl","version":"1.0"}}}' \
  | grep -i "mcp-session-id" | awk '{print $2}' | tr -d '\r')

echo "Session ID: $SESSION_ID"

# 2. List tools using the captured Session ID
curl -s -X POST https://mcp-fortiappsec.fortidemoscloud.com/mcp \
  -H "Content-Type: application/json" \
  -H "Mcp-Session-Id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

# 3. Call a tool (list WAF applications)
curl -s -X POST https://mcp-fortiappsec.fortidemoscloud.com/mcp \
  -H "Content-Type: application/json" \
  -H "Mcp-Session-Id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"waf_list_applications","arguments":{"appsec_api_key":"YOUR_API_KEY"}}}'

Run locally

# Docker (with API key from environment)
export FORTINET_APPSEC_API_KEY="your_api_key_here"
docker-compose up --build -d

# Or directly
uv sync
FORTINET_APPSEC_API_KEY="your_api_key_here" uv run uvicorn app.server:app --host 0.0.0.0 --port 8000

Server available at http://localhost:8000/mcp with health check at /health.

Deploy to Kubernetes

kubectl apply -f k8s-deployment.yaml

Exposes on NodePort 30082. Image: jviguerasfortinet/mcp-fortiappsec-server:v1.0.0

Tool Parameters

waf_create_application

Parameter

Required

Default

Description

app_name

Yes

—

Application name

domain_name

Yes

—

Primary domain name

server_address

Yes

—

Backend server address

appsec_api_key

No

""

FortiAppSec API key (uses env var if not provided)

server_port

No

80

Backend server port

extra_domains

No

""

Additional domains (comma-separated)

custom_port_http

No

80

HTTP listening port

custom_port_https

No

443

HTTPS listening port

cdn_status

No

0

CDN status (0=disabled, 1=enabled)

region

No

eu-west-1

Cloud region

platform

No

AWS

Platform type

block_mode

No

1

Block mode (0=monitor, 1=block)

service

No

http,https

Services (comma-separated)

server_type

No

http

Server type

server_country

No

Ireland

Server country

template_id

No

355e3ce6-...

Template ID

waf_list_applications / waf_list_templates

Parameter

Required

Description

appsec_api_key

No

FortiAppSec API key (uses FORTINET_APPSEC_API_KEY env var if not provided)

waf_get_application / waf_delete_application

Parameter

Required

Description

app_id

Yes

Application ID

appsec_api_key

No

FortiAppSec API key (uses FORTINET_APPSEC_API_KEY env var if not provided)

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • FortiCNAPP MCP Server

    jmvigueras
    A
    license
    Not graded
    quality
    D
    maintenance
    MCP server for managing Fortinet FortiCNAPP via AI agents, enabling vulnerability scanning, agent management, and compliance monitoring.
    MIT

  • fortigate-mcp

    oscardagrach
    A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that enables natural language management of FortiGate firewalls via the FortiOS REST API, offering 393 tools for system, policy, routing, VPN, and security configuration.
    MIT

  • wafpass-mcp

    WAF2p
    A
    license
    Not graded
    quality
    C
    maintenance
    Secure MCP server that exposes WAFpass REST endpoints as tools for AI assistants, with role-based filtering and token validation.
    Apache 2.0