Check Point Quantum Management

Exposes Check Point security management data for AI-powered automation and analysis.

This repository contains a collection of Model Context Protocol (MCP) servers for Check Point security platforms, implemented in TypeScript. Each MCP server is organized as a separate package within this monorepo structure.

Model Context Protocol (MCP) servers expose a structured, machine-readable API for your enterprise data—designed for AI-powered automation, copilots, and decision engines. By delivering a clear, contextual slice of your security environment, MCP lets you query, analyze, and optimize complex systems without building custom SDKs or parsing raw exports.

Security policies often span hundreds of rules and thousands of objects across diverse enforcement points. Understanding, auditing, or optimizing these environments is slow and error-prone.

MCP changes this: exposing security management data in a modular, context-rich format, ready for AI systems to consume. Enabling the AI to use your data with precision. Ask real-world questions, and get structured, actionable answers—instantly.

This monorepo is organized with each Check Point security domain as a separate MCP server:

- /packages- Contains all MCP server implementations and shared libraries

- /management- Management API MCP server for policy and object management
- /infra- Shared infrastructure components and utilities
- /management-logs- Management Logs MCP server for Check Point products
- /threat-prevention- Management API MCP Server for Threat Prevention policies
- /https-inspection- Management API MCP Server for Https Inspection policies
- /harmony-infra- Shared infrastructure components for Harmony products
- /harmony-sase- Harmony SASE MCP Server for SASE policy management
- /mcp-utils- Shared utilities for Check Point MCP servers
- /reputation-service- Reputation MCP Server
- /gw-cli-base- Base Infra for running Gateways scripts
- /gw-cli- Gateway Script MCP Server for Information, Perfomance and Diagnostics
- /gw-cli-connection-analysis- Gateway Script MCP Server to Analyze Connection Issues
- /threat-emulation- Threat Emulation MCP server for malware analysis and file scanning
- /gaia- GAIA OS MCP server for network management and interface configuration
- /documentation-tool- Check Point documentation assistant MCP server for product information and technical guidance
- /spark-management- Spark Management MCP server for Quantum Spark appliance management
- /cpinfo-analysis- CPInfo Analysis MCP server for Check Point appliance diagnostic file analysis and troubleshooting
- /argos-erm- Argos ERM MCP server for external risk management and threat intelligence
- /policy-insights- Policy Insights MCP server
- /checkpoint-waf- Check Point WAF MCP server for managing web application and APIs firewall assets, policies and configuration
- /cpview-history-mcp- CPView History MCP server for analyzing Check Point gateway performance databases
- /workforce-ai- Workforce AI MCP server for AI & Browse policy security management for AI Access, Chats, Agents and Secure Browsing, plus deployment and user visibility

The following MCP servers are available in this repository:

Here's an example of how to configure the Management MCP server in your MCP client:

{ "MCP-NAME": { "command": "npx", "args": [ "@chkp/MCP_NPM_PACKAGE" ], "env": { // Specific server configuration } } }

Each MCP server has its own specific configuration requirements. Please refer to the individual package README files for detailed setup instructions.

Getting Started for Development (Not needed for users who just wish to use the MCPs)

# Clone the repository git clone [repository-url] # Install dependencies npm install # Build all packages npm run build

This project uses Nx for managing the monorepo. You can use Nx commands to run tasks for specific packages:

- Alias:npm run nx:build:<folder-name>(e.g.,management,harmony-sase,infra)
- Direct Nx:npx nx build <full-package-name>(e.g.,@chkp/quantum-management-mcp)

# Run @chkp/management in development mode npx nx run @chkp/quantum-management-mcp:dev # or using alias npm run nx:dev:management # Run https-inspection in development mode npx nx run @chkp/https-inspection-mcp:dev # or using alias npm run nx:dev:https-inspection

# Build https-inspection server npx nx build @chkp/https-inspection-mcp # or using alias npm run nx:build:https-inspection # Build threat-prevention server npx nx build @chkp/threat-prevention-mcp # or using alias npm run nx:build:threat-prevention

# Run tests for a specific package npx nx run @chkp/quantum-infra:test # Run tests for all packages npx nx run-many --target=test

# Show project graph npx nx graph # List all available projects npx nx show projects # Build all packages npx nx run-many --target=build # Lint all packages npx nx run-many --target=lint

- Authentication keys and credentials are never shared with the model.They are used only by the MCP server to authenticate with your Check Point management system.
- Only use client implementations you trust.Malicious or untrusted clients could misuse your credentials or access data improperly.
- Queried Data will be exposed to the model.Ensure that you only use models and providers that comply with your organization's policies for handling sensitive data and PII.

Check Point collects anonymous usage statistics to improve MCP servers. Only tool usage patterns and anonymous identifiers are collected—no credentials, policies, or sensitive data.

Opt-Out:SetTELEMETRY_DISABLED=trueenvironment variable or use the--no-telemetryflag to disable telemetry collection.

Interact with the Illumio Policy Compute Engine (PCE) to manage workloads, labels, and analyze traffic flows.

Integrate with Tailscale's CLI and API for automated network management and monitoring.

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

A comprehensive MCP server for managing OPNsense firewalls, offering over 300 tools for configuration and monitoring.

Manage OPNsense firewalls using Infrastructure as Code (IaC) principles.

Overlay network for AI agents: permanent virtual address, encrypted UDP tunnels, NAT traversal, trust handshakes, and an app store of installable agent capabilities.

Create secure tunnels to expose local servers to the internet using untun.

This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting.

Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows