Provides tools for interacting with Cisco Secure Firewall Management Center (FMC), enabling management of devices, access control policies, network objects, security zones, and deployment of policy changes.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Cisco FMC MCP Server List all managed FTD devices and their health status."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server exposing Cisco Secure Firewall Management Center (FMC) operations over streamable HTTP, built as the demo target for Cisco AI Defense controlling MCP tool calls in-path.
New to this project? See
docs/user_guide.mdfor a step-by-step walkthrough: setting up your Python environment, pointing the server at your FMC, and connecting the Claude Desktop app. The sections below assume familiarity and go faster.
Copy .env.example to .env and fill in your FMC host, a dedicated
API-user's credentials, and a value for MCP_AUTH_TOKEN (the shared
secret clients must send as Authorization: Bearer <token>).
Set MCP_ALLOWED_HOSTS/MCP_ALLOWED_ORIGINS to match how this server
will actually be addressed (e.g. the hostname AI Defense uses to reach
it) — the SDK's DNS-rebinding protection denies every host by default.
Use a dedicated FMC API user, not a shared GUI admin account: FMC does not allow the same user to be logged into the API and the GUI at once. Grant that user the minimum role needed: the 8 read-only tools need only read access to devices, policies, and objects; the 3 write tools additionally need permission to create network objects, create/modify access control rules, and deploy policy changes -- a role like "Access Admin" (or an equivalent covering network-object and access-policy read/write plus deployment) is the practical minimum if the write tools will be used, while a read-only role suffices if they will not be.
Run locally: pip install -e ".[dev]" then fmc-mcp-server.
Run via Docker: docker compose up --build.
Related MCP server: cisco-secure-access-mcp
Point AI Defense (or any in-path proxy enforcing its policies) at this
server's http://<host>:8765/mcp endpoint. This server's own bearer-token
check is a baseline control independent of AI Defense — it means the
server is never accidentally left open before AI Defense is wired in.
Tool | Risk | Description |
| read-only | Managed FTD devices, model, health status |
| read-only | Full detail for one device |
| read-only | Access control policies |
| read-only | Pending-changes status for a device |
| read-only | Search rules in a policy |
| read-only | Reverse lookup: rules referencing an IP/FQDN |
| read-only | Search host/network/FQDN objects |
| read-only | Security zones |
| write | Create a host/network/FQDN object |
| write | Append a rule to a policy |
| write, most consequential | Push pending changes to live devices |
Every tool declares standard MCP ToolAnnotations (readOnlyHint,
destructiveHint, idempotentHint) so a policy layer like AI Defense can
key off that metadata rather than tool names.
pytest -v runs the full suite (FMCClient auth/refresh/pagination, every
tool against mocked FMC responses, the bearer middleware, and the assembled
server). A manual smoke test against a real/lab FMC via
npx @modelcontextprotocol/inspector is recommended before treating the
server as demo-ready.
FMC_VERIFY_SSL=false is an explicit, lab-only opt-out — production
deployments must supply a trusted certificate or CA bundle.
Credentials and tokens are never logged; audit log entries redact any sensitive-looking argument keys.
The three write tools exist specifically so the AI Defense demo has real actions worth blocking. Consider removing or further gating them for any non-demo deployment.
This server cannot be deployed
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
