# PanOS MCP Server

MCP (Model Context Protocol) server for Palo Alto Networks firewalls and Panorama, built in Python with streamable HTTP transport and bearer token authentication.

## Syncing Changes from Original Repo

This project is based on [apius-tech/Palo-MCP](https://github.com/apius-tech/Palo-MCP).

### How to Sync New Changes from Upstream

When the upstream repo is updated:

1. Fetch the latest changes: `git fetch origin` or clone fresh
2. Compare tool modules against this project's `src/tools/` directory
3. For each new or changed tool, update the corresponding Python file
4. Rebuild and test: `docker build -t palo-mcp . && docker restart palo-mcp`

## Quick Start

```bash
# Set your auth token (required)
export MCP_BEARER_TOKEN="your-secret-token"

# Build and run
docker build -t palo-mcp . && docker run -d --name palo-mcp \
  --env-file .env -p 8000:8000 --restart unless-stopped palo-mcp
```

The server exposes an MCP endpoint at `http://localhost:8000/mcp`.

## Authentication

All requests require a `Authorization: Bearer <token>` header. Set the token via:

- Environment variable: `MCP_BEARER_TOKEN`
- `.env` file (loaded by Docker)

## Configuration

| Variable | Default | Description |
|---|---|---|
| `MCP_BEARER_TOKEN` | *(required)* | Bearer token for auth |
| `MCP_ISSUER_URL` | `https://localhost` | Auth issuer URL |
| `MCP_RESOURCE_URL` | `http://127.0.0.1:8000/mcp` | Resource server URL |
| `SERVER_HOST` | `0.0.0.0` | Bind address |
| `SERVER_PORT` | `8000` | Bind port |
| `MCP_ALLOWED_HOSTS` | *(localhost and `palo-mcp`)* | Additional comma-separated Host headers allowed by DNS-rebinding protection |
| `MCP_ALLOWED_ORIGINS` | *(localhost)* | Additional comma-separated browser Origin headers allowed by DNS-rebinding protection |

The Streamable HTTP endpoint is `/mcp`. If the server is reached through a reverse proxy or a different DNS name, add that hostname to `MCP_ALLOWED_HOSTS` (including the port when the proxy preserves it). Browser-based clients may also require their exact origin in `MCP_ALLOWED_ORIGINS`.

### Upstream Reference

- **Repo**: https://github.com/apius-tech/Palo-MCP
- **Original language**: TypeScript (FastMCP)
- **This implementation**: Python (MCPServer with streamable HTTP)