Fortinet MCP Server

A completeModel Context Protocol (MCP)server for Fortinet FortiOS 7.6.x — exposing the entire REST API (1536 endpoints) as typed MCP tools usable from Claude Desktop, Cursor, or any MCP-compatible client.

- Features
- Tool Categories
- Requirements
- Quick Start

- 1. Create API Token on FortiGate
- 2. Install dependencies
- 3. Configure environment
- 4. Run with MCP Inspector
- 5. Install in Claude Desktop

git clone https://github.com/paoloamato2/fortinet-mcp-server.git cd fortinet-mcp-server # Using uv (recommended) uv sync # Or using pip pip install -e .

FORTIOS_HOST=https://192.168.1.1 FORTIOS_API_TOKEN=your-token-here FORTIOS_VDOM=root FORTIOS_VERIFY_SSL=false FORTIOS_TIMEOUT=30

uv run mcp install server.py --name "FortiOS"

{ "mcpServers": { "fortios": { "command": "uv", "args": [ "run", "--directory", "/absolute/path/to/fortinet-mcp-server", "python", "server.py" ], "env": { "FORTIOS_HOST": "https://192.168.1.1", "FORTIOS_API_TOKEN": "your-api-token", "FORTIOS_VDOM": "root", "FORTIOS_VERIFY_SSL": "false" } } } }

OnmacOS,claude_desktop_config.jsonis at~/Library/Application Support/Claude/claude_desktop_config.json.
OnWindows, it is at%APPDATA%\Claude\claude_desktop_config.json.

To run as a remote HTTP server instead of stdio:

MCP_TRANSPORT=streamable-http MCP_PORT=8000 uv run server.py

This mode is useful for shared team setups or cloud-hosted deployments.

Once installed, you can ask Claude natural-language questions such as:

- "Show me all firewall policies that deny traffic"
- "Which IPsec tunnels are currently down?"
- "List all interfaces with their IP addresses"
- "Which route would be used to reach 8.8.8.8?"
- "Show the top 20 traffic sources in FortiView"
- "Are there any failed admin login attempts in the logs?"

# List firewall policies filtered by action firewall_policy_list(filter_action="deny") # Get system status system_status() # Check IPsec VPN tunnels monitor_vpn_ipsec() # Query forward traffic logs for a specific source IP log_traffic_forward(srcip="10.10.1.100", rows=50) # Generic: list any CMDB resource (full API coverage) cmdb_list("casb/profile") cmdb_list("wireless-controller.hotspot20/hs-profile") # Generic: get any monitor data monitor_get("registration/forticloud")

fortinet-mcp-server/ ├── server.py # FastMCP entry point, lifespan, tool registration ├── fortios_client.py # Async HTTP client (CMDB/Monitor/Log/Service) ├── pyproject.toml # Project metadata and dependencies ├── .env.example # Environment variable template ├── README.md # This file └── tools/ ├── __init__.py ├── generic.py # Generic pass-through tools (all 1536 endpoints) ├── system.py # System config + monitoring ├── firewall.py # Firewall policies, addresses, VIPs, sessions ├── vpn.py # IPsec + SSL VPN config and monitoring ├── router.py # Static routes, OSPF, BGP, SD-WAN ├── user.py # Local users, groups, RADIUS, LDAP, sessions ├── monitor.py # Network monitoring, FortiView, endpoint control ├── log.py # Log retrieval and configuration ├── security.py # IPS, AV, webfilter, DLP, WAF, ZTNA profiles └── wireless.py # WiFi APs, SSIDs, clients, rogue APs

- The API token grants the same access level as its associated admin profile. Follow theprinciple of least privilege— create a restricted profile if you only need read access.
- SetFORTIOS_VERIFY_SSL=truein production and ensure your FortiGate has a valid TLS certificate.
- The server runslocally over stdioby default — it is not exposed over the network unless HTTP mode is enabled.
- Never commit your.envfile or expose your API tokenin logs, issues, or code.
- Rotate your API token regularly and revoke it immediately if compromised.

Contributions are welcome! Please readCONTRIBUTING.mdbefore submitting a pull request.

- Bug reports and feature requests →open an issue
- Security vulnerabilities → seeSECURITY.md
- Code of conduct →CODE_OF_CONDUCT.md

This project is licensed under theMIT License— seeLICENSEfor details.

Security testing MCP server with 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment.