How do I use fortigate-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@fortigate-mcp show me the FortiGate system status" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

fortigate-mcp

by PeerapolSelanon

Overview Schema Source Related Servers Discussions Admin

JavaScript

Remote

FortiGate MCP Server (Safe Write Capable)

Write tools are dry-run by default and require explicit environment and per-call confirmation. See SAFE_WRITE_MODE.md.

MCP Server สำหรับให้ Claude Desktop เชื่อมต่อกับ FortiGate ผ่าน REST API ใช้ได้เฉพาะอ่าน config (read-only) ปลอดภัย ไม่สามารถแก้ไขได้

✨ Features

🔐 Read-only — แม้ token หลุดก็แก้ config ไม่ได้
🐳 Docker — isolated environment
📡 stdio transport — ไม่ต้องเปิด port
🛡️ Trusted host enforcement บน FortiGate

Related MCP server: FortiGate MCP Server

🛠️ Tools ที่ใช้ได้

Tool	หน้าที่
`fortigate_get_system_status`	ดู firmware version, hostname, etc.
`fortigate_list_address_groups`	ดูรายชื่อ address group ทั้งหมด
`fortigate_get_address_group`	ดู member ใน group
`fortigate_list_addresses`	ดูรายชื่อ address object
`fortigate_get_address`	ดู IP จริงของ address object
`fortigate_list_policies`	ดู policy ทั้งหมด
`fortigate_get_policy`	ดู policy ตัวเดียวละเอียด
`fortigate_list_webfilter_profiles`	ดู web filter profile
`fortigate_get_webfilter_profile`	ดู URL allow/block ใน profile
`fortigate_list_services`	ดู custom service
`fortigate_create_policy`	Safely create firewall policy, dry-run by default
`fortigate_update_policy`	Safely update firewall policy after reading current state

📦 Setup

1. Clone/copy โปรเจกต์ลงเครื่อง

วาง folder fortigate-mcp ไว้ที่ไหนก็ได้ เช่น:

Windows: C:\mcp\fortigate-mcp
Mac/Linux: ~/mcp/fortigate-mcp

2. ตั้งค่า .env

cp .env.example .env

แก้ .env:

FORTIGATE_HOST=172.16.1.X        # IP ของ FortiGate
FORTIGATE_TOKEN=xxxxxxxxxxxx     # token จาก REST API admin
FORTIGATE_VERIFY_SSL=false       # true ถ้ามี valid cert
FORTIGATE_TIMEOUT=10000

3. Build Docker image

cd fortigate-mcp
docker compose build

4. ทดสอบ container ทำงาน

# ทดสอบ run แบบ interactive (Ctrl+C เพื่อออก)
docker compose run --rm fortigate-mcp

ถ้าเห็น log:

[FortiGate MCP] Server running on stdio
[FortiGate MCP] Connected to: 172.16.1.X
[FortiGate MCP] Mode: READ-ONLY

แสดงว่า container ทำงานได้ ✅

หมายเหตุ: server จะรอ MCP protocol input จาก stdin — ถ้าไม่มี input ก็ปกติ Ctrl+C ปิดได้เลย

5. Register กับ Claude Desktop

แก้ไฟล์ config ของ Claude Desktop:

Windows: %APPDATA%\Claude\claude_desktop_config.json Mac: ~/Library/Application Support/Claude/claude_desktop_config.json

เพิ่ม mcpServers:

{
  "mcpServers": {
    "fortigate": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "--env-file",
        "C:\\path\\to\\fortigate-mcp\\.env",
        "fortigate-mcp:latest"
      ]
    }
  }
}

⚠️ Windows: ใช้ \\ แทน \ ในเส้นทางไฟล์ Mac/Linux: ใช้ /path/to/fortigate-mcp/.env

6. Restart Claude Desktop

ปิดเปิด Claude Desktop ใหม่ทั้งหมด (ไม่ใช่แค่ปิดหน้าต่าง — quit จาก system tray)

7. ทดสอบ

ถาม Claude ว่า:

"ลอง fortigate_get_system_status FortiGate ของฉันหน่อย"

ถ้าได้ข้อมูล hostname ETTFAC กลับมา = สำเร็จ! 🎉

🔍 ตัวอย่างคำถาม

"ip068 อยู่ใน address group ไหนบ้าง?"
"Web filter profile 'Only Use AI' allow domain อะไรบ้าง?"
"Custom service 'Everest_default' ใช้ port อะไร?"
"policy ไหนที่ใช้ source 'Wifi'?"

🛡️ Security Notes

✅ Token เก็บใน .env ไม่ถูก commit (มี .gitignore)
✅ Container รันด้วย non-root user
✅ Trusted host enforcement บน FortiGate
✅ Read-only profile บน FortiGate (defense in depth)
⚠️ อย่า commit .env ลง git
⚠️ อย่า share token กับใคร (รวมถึงในแชต Claude)

🐛 Troubleshooting

`Error: connect ECONNREFUSED`

เช็คว่า FortiGate IP ถูกต้องใน .env
เช็คว่าเครื่องที่รัน Docker เข้าถึง FortiGate ได้ (ลอง ping)

`FortiGate API error (401)`

Token ผิด หรือ expire — regenerate ใหม่ที่ FortiGate

`FortiGate API error (403)`

Trusted host ไม่ตรง — เช็ค IP ของเครื่องที่รัน Docker
Container อาจใช้ IP ต่างจาก host (ลอง network_mode: host ใน docker-compose)

Claude Desktop ไม่เห็น tool

เช็คว่า restart Claude Desktop แล้วจริงหรือยัง (quit จาก tray)
เช็ค path ใน claude_desktop_config.json ถูกต้อง
ดู log ที่ %APPDATA%\Claude\logs\ (Windows)

Available Tools

18 tools

fortigate_create_addressCreate address object (safe)A

Safely create a firewall address object. Defaults to dry_run=true. To apply, set FORTIGATE_ENABLE_WRITE=true and pass confirm exactly as the configured confirmation phrase.

Inputs: name (required), type, subnet, fqdn, +3 more.

fortigate_create_address_groupCreate address group (safe)A

Safely create a firewall address group with explicit members. Defaults to dry_run=true.

Inputs: name (required), members (required), comment, dry_run, +1 more.

fortigate_create_policyCreate firewall policy (safe)A

Safely create a firewall policy. Defaults to dry_run=true. To apply, set FORTIGATE_ENABLE_WRITE=true and pass confirm exactly as the configured confirmation phrase.

Inputs: name (required), srcintf (required), dstintf (required), srcaddr (required), +23 more.

fortigate_delete_addressDelete address object (safe)A

DestructiveIdempotent

Safely delete a firewall address object. Reads the current object first and defaults to dry_run=true.

Inputs: name (required), dry_run, confirm.

fortigate_delete_address_groupDelete address group (safe)A

DestructiveIdempotent

Safely delete a firewall address group. Reads the current object first and defaults to dry_run=true.

Inputs: name (required), dry_run, confirm.

fortigate_get_addressGet address object detailsA

Read-only

Get details of a specific firewall address object (the actual IP/subnet it represents).

Inputs: name (required).

fortigate_get_address_groupGet address group detailsA

Read-only

Get full details of a specific address group, including all member IPs/addresses. Useful for finding which IPs are in groups like 'Wifi', 'IT Team', 'Only Use AI'.

Inputs: name (required).

fortigate_get_policyGet firewall policy detailsA

Read-only

Get full details of a specific firewall policy by ID.

Inputs: policyid (required).

fortigate_get_system_statusGet FortiGate system statusA

Read-only

Get FortiGate system status (firmware version, hostname, serial, uptime). Use this first to verify connectivity.

Inputs: no named parameters.

fortigate_get_webfilter_profileGet web filter profile detailsA

Read-only

Get full details of a web filter profile, including URL filters (allow/block lists) and category filters. Useful for understanding what 'Only Use AI', 'Translator Google' profiles allow.

Inputs: name (required).

fortigate_list_addressesList address objectsA

Read-only

List all firewall address objects (single IPs/subnets, just names). Useful for finding objects like 'ip068', 'ip080'.

Inputs: no named parameters.

fortigate_list_address_groupsList address groupsA

Read-only

List all firewall address groups (just names). Use this to find which group contains a specific IP, or to see available groups before calling fortigate_get_address_group.

Inputs: no named parameters.

fortigate_list_policiesList firewall policiesA

Read-only

List all firewall policies in order with key fields (id, name, src, dst, service, action). Top of list = highest priority. Use this to understand traffic flow rules.

Inputs: no named parameters.

fortigate_list_servicesList custom servicesA

Read-only

List all custom firewall services (just names). Useful for understanding services like 'Everest_default', 'anydesk_6568'.

Inputs: no named parameters.

fortigate_list_webfilter_profilesList web filter profilesA

Read-only

List all web filter profiles (just names).

Inputs: no named parameters.

fortigate_update_addressUpdate address object (safe)A

Idempotent

Safely update a firewall address object. Reads the current object first and defaults to dry_run=true.

Inputs: name (required), type, subnet, fqdn, +3 more.

fortigate_update_address_group_membersUpdate address group members (safe)A

Idempotent

Safely add, remove, or replace address group members. Reads current members first and defaults to dry_run=true.

Inputs: name (required), action (required), members (required), dry_run, +1 more.

fortigate_update_policyUpdate firewall policy (safe)A

Idempotent

Safely update a firewall policy. Reads the current policy first and defaults to dry_run=true.

Inputs: policyid (required), name, srcintf, dstintf, +23 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4/5.0

Scored 2026-06-22 11:15 across 18 tools

Disambiguation5/5

Each tool has a clear, distinct purpose targeting specific resources (address, address group, policy, service, web filter profile, system status). No overlapping functionality; get and list are appropriately separated.

Naming Consistency5/5

All tools follow the consistent pattern 'fortigate_verb_noun' with lowercase and underscores. Verbs are uniform: create, delete, get, list, update. No mixing of conventions.

Tool Count4/5

18 tools is slightly above the typical 3-15 range but still well-scoped for managing a FortiGate firewall. Each tool serves a necessary function without redundancy.

Completeness3/5

Covers CRUD for addresses and address groups, and list/get for policies, services, and web filter profiles. Notable gaps: missing delete for policies, and no create/update/delete for services and web filter profiles.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Fortare for Fortnox
ai.fortare
Connect ChatGPT and Claude to Fortnox: invoices, customers, reports. Every write needs your OK.
ERP Systems Finance
1
https://fortare.ai/mcp
ShellwayA
com.getshellway
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Command Line Developer Tools Networking & Infrastructure
221
https://mcp.getshellway.com/mcp
ShareWatchA
ai.sharewatch
Give Claude only the Google Drive files you choose. Every action logged.
Cloud Storage File Systems Workplace & Productivity
1
https://sharewatch.ai/mcp
Sage Intacct MCP by superglue
ai.superglue
Read and write Sage Intacct from Claude or ChatGPT. Write tools are flagged for approval.
ERP Systems Finance
1
https://api.superglue.cloud/mcp/sage-intacct

Related MCP Servers

FortiOS 7.6.x MCP Server
Networking & Infrastructure Security Monitoring
paoloamato2
A
license
B
quality
D
maintenance
A complete MCP server for Fortinet FortiOS 7.6.x that exposes the entire REST API as typed MCP tools for use with MCP-compatible clients like Claude Desktop.
Updated 7 months ago (2026-04-07 09:21 UTC)
100
11
MIT
FortiGate MCP Server
Networking & Infrastructure Security
humyai99
A
license
Not graded
quality
D
maintenance
Provides programmatic access to FortiGate devices for managing firewall policies, routing, virtual IPs, and device operations, enabling integration with MCP-compatible clients like Claude Desktop.
Updated 3 months ago (2026-07-28 05:59 UTC)
MIT
fortigate-mcp-server
Networking & Infrastructure Security
ry-ops
A
license
B
quality
B
maintenance
Lets Claude or any MCP client manage a Fortinet FortiGate firewall through the FortiOS 7.6 REST API, covering firewall policies, NAT and port forwards, DNS and DHCP, application control, certificates, and live traffic and logs. It adds read-only and dry-run guardrails, clear FortiOS error explanations, and optional k3s and Proxmox integrations that keep firewall objects in sync with clusters and hypervisors.
Updated a month ago (2026-10-11 18:26 UTC)
88
5
MIT
pfSense MCP Server
Networking & Infrastructure Security
marcoskarahan
F
license
Not graded
quality
Not graded
maintenance
Connects MCP clients such as Claude Desktop or Claude Code to a pfSense firewall so users can inspect and change rules, NAT, VPNs, DNS, DHCP, certificates, services, and diagnostics through plain-language conversation. Every destructive action is rate-limited, confirmation-gated, validated against the pfSense REST API wire format, and paired with a captured config revision for rollback.
Updated a month ago (2026-10-14 15:25 UTC)
-

FortiGate MCP Server (Safe Write Capable)

✨ Features

🛠️ Tools ที่ใช้ได้

📦 Setup

1. Clone/copy โปรเจกต์ลงเครื่อง

2. ตั้งค่า .env

3. Build Docker image

4. ทดสอบ container ทำงาน

5. Register กับ Claude Desktop

6. Restart Claude Desktop

7. ทดสอบ

🔍 ตัวอย่างคำถาม

🛡️ Security Notes

🐛 Troubleshooting

Error: connect ECONNREFUSED

FortiGate API error (401)

FortiGate API error (403)

Claude Desktop ไม่เห็น tool

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

FortiOS 7.6.x MCP Server

FortiGate MCP Server

fortigate-mcp-server

pfSense MCP Server

`Error: connect ECONNREFUSED`

`FortiGate API error (401)`

`FortiGate API error (403)`