PanOS MCP Server

MCP (Model Context Protocol) server for Palo Alto Networks firewalls and Panorama, built in Python with streamable HTTP transport and bearer token authentication.

Syncing Changes from Original Repo

This project is based on apius-tech/Palo-MCP.

How to Sync New Changes from Upstream

When the upstream repo is updated:

1. Fetch the latest changes: git fetch origin or clone fresh

2. Compare tool modules against this project's src/tools/ directory

3. For each new or changed tool, update the corresponding Python file

4. Rebuild and test: docker build -t palo-mcp . && docker restart palo-mcp

Related MCP server: CheckPoint MCP Servers Explorer

Quick Start

# Set your auth token (required)
export MCP_BEARER_TOKEN="your-secret-token"

# Build and run
docker build -t palo-mcp . && docker run -d --name palo-mcp \
  --env-file .env -p 8000:8000 --restart unless-stopped palo-mcp

The server exposes an MCP endpoint at http://localhost:8000/mcp.

Authentication

All requests require a Authorization: Bearer <token> header. Set the token via:

• Environment variable: MCP_BEARER_TOKEN

• .env file (loaded by Docker)

Configuration

The Streamable HTTP endpoint is /mcp. If the server is reached through a reverse proxy or a different DNS name, add that hostname to MCP_ALLOWED_HOSTS (including the port when the proxy preserves it). Browser-based clients may also require their exact origin in MCP_ALLOWED_ORIGINS.

Upstream Reference

• Repo: https://github.com/apius-tech/Palo-MCP

• Original language: TypeScript (FastMCP)

• This implementation: Python (MCPServer with streamable HTTP)