Skip to main content
Glama
rstierli

FortiManager MCP Server

by rstierli

get_device_interface_config

Read a device's interface configuration from FortiManager's device DB, filtered by VLAN ID or exact interface name, to map a queried IP or client to its VLAN, interface, and physical port.

Instructions

Read a device's interface CONFIG objects from FortiManager's device DB.

Unlike get_device_interfaces (which proxies the live FortiGate monitor API and cannot filter by VLAN), this reads the interface configuration FortiManager keeps in its device database and supports server-side filtering by VLAN id and/or exact interface name. Use it to map a queried IP / client to the VLAN, interface and physical port it belongs to.

Args: device: Managed device name (e.g. "FGT-HQ"). Defaults to DEFAULT_DEVICE when omitted; required if that is not configured. vlanids: Optional list of VLAN ids to filter on (matches vlanid in) name: Optional exact interface name to filter on (e.g. "port1")

Returns: dict with keys: - device - interfaces: raw device-DB interface config (list or dict), credential fields stripped -- see _INTERFACE_SECRET_FIELDS - summary: condensed per-interface list (name/alias/vlanid/ip/...) - interface_count: number of summarized interfaces - error / error_code: on failure

Input Schema

NameRequiredDescriptionDefault
nameNo
deviceNo
vlanidsNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.12.0

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full load and does well: it discloses the data source (device DB vs live API), server-side filtering behavior, credential-field stripping, and the presence of error/error_code on failure. It stops short of mentioning permission requirements or whether the read is cached/stale, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and sibling differentiation are front-loaded in the first two sentences, and each subsequent sentence adds information. The Returns block partially duplicates the existing output schema, which is modest waste, though the Args block earns its space given 0% schema coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, 3-optional-parameter tool with an output schema, the description covers everything an agent needs: what it reads, where the data comes from, how it differs from the alternative sibling, how each filter behaves, and how errors surface. No significant gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: device is documented with its DEFAULT_DEVICE fallback and the case where it becomes required, vlanids with its 'vlanid in' matching semantics, and name as an exact-match filter. All three parameters gain meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — reading interface CONFIG objects from FortiManager's device DB — and immediately contrasts it with the sibling get_device_interfaces, which proxies the live monitor API. An agent can distinguish the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the alternative (get_device_interfaces) and the condition that separates them (device DB vs live monitor API, VLAN filtering support). It also supplies a concrete use case: mapping a queried IP/client to VLAN, interface and physical port.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools