Name: Illumio MCP Server
Author: alexgoller

LABSCO SUMMARY

create-ringfence turns a traffic analysis into a ruleset, not a report.

It discovers which remote apps actually talk to a target app and builds the segmentation policy from that, which is the step people usually do by hand between the flow query and the rule editor. Run compare-draft-active before provisioning: it shows exactly which rulesets, rules, IP lists and services would change.

What it is

An MCP server for the Illumio Policy Compute Engine. It covers workloads, labels, IP lists, services and rulesets, plus traffic analysis, automated ringfencing, enforcement readiness and compliance checks.

What you get

Full CRUD on workloads, labels, IP lists, services and rulesets
Traffic analysis: get-traffic-flows with filters, and get-traffic-flows-summary grouped by app, env, port and protocol
Automated segmentation: create-ringfence for one app, ringfence-batch for many, with a dry-run mode
Deny rules including override deny: create-deny-rule, update-deny-rule, delete-deny-rule
Readiness and coverage: enforcement-readiness, get-policy-coverage-report, get-workload-enforcement-status
Risk analysis: identify-infrastructure-services, find-unmanaged-traffic, detect-lateral-movement-paths
compliance-check against PCI-DSS, NIST 800-53, CIS Controls or general best practice
Provisioning: compare-draft-active to preview, then provision-policy to apply

Requirements

Python 3.8+ and an Illumio PCE with API credentials. The stdio path takes PCE_HOST, PCE_PORT, PCE_ORG_ID, API_KEY and API_SECRET; install with uv sync and run illumio-mcp. There is also an HTTP server, illumio-mcp-http, with SSO and either per-user or shared PCE credentials selected by MCP_PCE_MODE.

Setup effort

Build from source — git clone https://github.com/alexgoller/illumio-mcp-server.git

See installation options

USE CASES

01

Segmenting an app without hand-writing the rules

Summarize its traffic, then generate the ruleset from what the flows show.

get-traffic-flows-summarycreate-ringfence

02

Checking whether an app is ready to enforce

Get a readiness score with recommendations, and see what policy already covers.

enforcement-readinessget-policy-coverage-report

03

Seeing what provisioning would change

Diff draft against active first, then provision with a change description for the audit trail.

compare-draft-activeprovision-policy

04

Finding the blind spots before an attacker does

Look for unlabelled traffic and for bridge nodes whose compromise opens up the rest.

find-unmanaged-trafficdetect-lateral-movement-paths

41 tools

Listed in project docs. Your client may show a different list.

get-workloads

create-workload

update-workload

delete-workload

get-labels

create-label

update-label

delete-label

get-rulesets

create-ruleset

update-ruleset

delete-ruleset

create-deny-rule

update-deny-rule

delete-deny-rule

BEFORE YOU INSTALL

What to know first

Tools you get

41 tools named in the project's documentation.

Requires

Python 3.8+
API_KEY in your environment
API_SECRET in your environment
PCE_HOST in your environment
PCE_ORG_ID in your environment

INSTALLATION

Connect your client

Server setup

TERMINAL

git clone https://github.com/alexgoller/illumio-mcp-server.git
cd illumio-mcp-server
uv sync

MCP Clients

Claude Desktop, Cursor

JSON

{
  "mcpServers": {
    "illumio-mcp": {
      "command": "uv",
      "args": [
        "--directory",
        "<YOUR_PATH_TO_ILLUMIO_MCP_SERVER>",
        "run",
        "illumio-mcp"
      ],
      "env": {
        "PCE_HOST": "<YOUR_PCE_HOST>",
        "PCE_PORT": "8443",
        "PCE_ORG_ID": "1",
        "API_KEY": "<YOUR_API_KEY>",
        "API_SECRET": "<YOUR_API_SECRET>"
      }
    }
  }
}

Claude Desktop — Docker

Create an environment file (e.g. ~/.illumio-mcp.env) with your PCE credentials:

FILE · .illumio-mcp.env

PCE_HOST=<YOUR_PCE_HOST>
PCE_PORT=<YOUR_PCE_PORT>
PCE_ORG_ID=1
API_KEY=<YOUR_API_KEY>
API_SECRET=<YOUR_API_SECRET>

Then add this to your Claude Desktop config file:

CLAUDE DESKTOP — DOCKER · JSON

{
  "mcpServers": {
    "illumio-mcp-docker": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--init",
        "--rm",
        "--env-file",
        "/Users/<YOUR_USERNAME>/.illumio-mcp.env",
        "ghcr.io/alexgoller/illumio-mcp-server:latest"
      ]
    }
  }
}

<YOUR_USERNAME> is your actual username, so --env-file points at the file you created.

MCP Inspector — test run

MCP INSPECTOR — TEST RUN · TERMINAL

npx @modelcontextprotocol/inspector --cli http://127.0.0.1:8080/mcp --transport http --method tools/list

Start the server first with MCP_DEV_INSECURE=1 illumio-mcp-http (local testing only, no auth check). --transport http selects Streamable HTTP; without it the Inspector assumes SSE for a URL.

Illumio MCP Server