LABSCO SUMMARY

Vendor-maintained, and split by product so you load only the security domain you work in.

A security policy can span hundreds of rules and thousands of objects, and the value here is asking a real question and getting a structured answer instead of parsing exports. The monorepo is many independent servers — the management one for policy and objects, the logs one for audit trails — each with its own credentials, so you enable exactly the surface your task needs.

What it is

A monorepo of MCP servers for Check Point security products, each a separate package covering one domain — management, logs, threat prevention, and more.

What you get

Management (@chkp/quantum-management-mcp) — query policies, rules, objects and network topology
Management Logs (@chkp/management-logs-mcp) — query and gain insight from connection and audit logs
Threat Prevention (@chkp/threat-prevention-mcp) — policies, profiles, indicators, IPS updates and IOC feeds
HTTPS Inspection (@chkp/https-inspection-mcp) — inspection policies, rules and exceptions
Harmony SASE (@chkp/harmony-sase-mcp) — SASE regions, networks and applications
Reputation Service (@chkp/reputation-service-mcp) — URL, IP and file reputation
GW CLI (@chkp/quantum-gw-cli-mcp) — gateway diagnostics across hardware, network, HA and performance
Threat Emulation, Gaia OS, Spark management, WAF, policy insights and a documentation assistant

Requirements

Each server is a separate npm package launched with npx, with its own configuration and credentials — refer to the individual package README for what a given server needs. Development against the monorepo uses npm install and npm run build; end users only install the specific servers they want.

Setup effort

One command — npx -y @chkp/argos-erm-mcp

See installation options

USE CASES

01

Auditing a sprawling security policy

Query the management server for the rules and objects that apply, and ask real-world questions of them.

02

Investigating an incident in the logs

Query connection and audit logs through the management-logs server for the events that matter.

03

Checking whether something is malicious

Look up the reputation of a URL, IP or file before acting on it.

04

Diagnosing a gateway

Run the GW CLI server for hardware, network, HA and performance diagnostics.

05

Reviewing threat-prevention coverage

Query the threat-prevention server for policies, profiles and the current IPS and IOC state.

BEFORE YOU INSTALL

What to know first

Requires

npx on PATH

INSTALLATION

Connect your client

Add the block to your client, or run the command directly.

Server setup

Configuration file

JSON

{
  "mcpServers": {
    "argos-erm-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@chkp/argos-erm-mcp"
      ]
    }
  }
}

npx

TERMINAL

npx -y @chkp/argos-erm-mcp

Check Point Quantum Management