Skip to main content
Glama
rstierli

FortiManager MCP Server

by rstierli

get_device_sdwan

Retrieve a managed FortiGate's local SD-WAN configuration—members, zones, health checks, and steering rules—from FortiManager's device DB when no wanprof template is assigned.

Instructions

Get a managed device's SD-WAN configuration from FortiManager's device DB.

Unlike get_sdwan_template (which reads wanprof templates in an ADOM), this reads the SD-WAN config local to the device itself -- members/zones, health-checks and service (steering) rules -- from the device database FortiManager keeps in sync with the FortiGate. Use this when a device runs SD-WAN but has no wanprof template assigned (list_sdwan_templates returns nothing) yet you still need its members, zones and steering rules.

Args: device: Managed device name (e.g. "myfw01") vdom: VDOM name (default: "root")

Returns: dict with keys: - device, vdom - sdwan: raw system/sdwan config object - summary: condensed members/zones/health-checks/service rules - error / error_code: on failure

Input Schema

NameRequiredDescriptionDefault
vdomNoroot
deviceYes

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.12.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden; it discloses that this is a read of the device DB, what config areas are covered (members/zones, health-checks, service rules), and that failures surface as error/error_code keys. It does not state permission requirements or behavior when the device has no SD-WAN config at all, leaving a small gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the sibling distinction are front-loaded in the first paragraph, with usage guidance before the Args block. The Returns section largely duplicates the existing output schema, which is mild waste, but the text is organized and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, the return listing is redundant but harmless; the description covers what it reads, when to use it versus template tools, both parameters, and error keys. The only real gap is behavior when the device has no local SD-WAN config.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate; it documents both params -- device as the managed device name with an example ("myfw01") and vdom with the default "root". That is meaningful added semantics over the bare schema, though it omits whether vdom accepts non-root values or how to discover them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource and scope: reads a managed device's SD-WAN config from FortiManager's device DB, and explicitly contrasts it with get_sdwan_template reading wanprof templates in an ADOM. An agent can distinguish it from the SD-WAN template siblings without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative (get_sdwan_template) and the exact selecting condition: use this when a device runs SD-WAN but has no wanprof template assigned, evidenced by list_sdwan_templates returning nothing, yet members/zones/steering rules are still needed. Explicit when-to-use and when-to-prefer-a-sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools