It discovers which remote apps actually talk to a target app and builds the segmentation policy from that, which is the step people usually do by hand between the flow query and the rule editor. Run compare-draft-active before provisioning: it shows exactly which rulesets, rules, IP lists and services would change.
An MCP server for the Illumio Policy Compute Engine. It covers workloads, labels, IP lists, services and rulesets, plus traffic analysis, automated ringfencing, enforcement readiness and compliance checks.
- Full CRUD on workloads, labels, IP lists, services and rulesets
- Traffic analysis: get-traffic-flows with filters, and get-traffic-flows-summary grouped by app, env, port and protocol
- Automated segmentation: create-ringfence for one app, ringfence-batch for many, with a dry-run mode
- Deny rules including override deny: create-deny-rule, update-deny-rule, delete-deny-rule
- Readiness and coverage: enforcement-readiness, get-policy-coverage-report, get-workload-enforcement-status
- Risk analysis: identify-infrastructure-services, find-unmanaged-traffic, detect-lateral-movement-paths
- compliance-check against PCI-DSS, NIST 800-53, CIS Controls or general best practice
- Provisioning: compare-draft-active to preview, then provision-policy to apply
Python 3.8+ and an Illumio PCE with API credentials. The stdio path takes PCE_HOST, PCE_PORT, PCE_ORG_ID, API_KEY and API_SECRET; install with uv sync and run illumio-mcp. There is also an HTTP server, illumio-mcp-http, with SSO and either per-user or shared PCE credentials selected by MCP_PCE_MODE.
One command plus a key — uv sync, then supply credentials