That pairing is what keeps this usable. The typed tools give the model good arguments for the questions people actually ask, and when someone needs an endpoint nobody wrapped, `cmdb_list` takes the raw resource path instead of returning nothing. Set FORTIOS_VERIFY_SSL=true in production, and remember the API token carries exactly the privileges of the admin profile behind it — a read-only profile is the right start.
A FortiOS 7.6.x server. It exposes the FortiGate REST API as typed MCP tools organised by functional area, and backs them with generic pass-through tools that cover the rest of the API.
- 204+ typed tools across system, firewall, VPN, router, user, monitor, log, security and wireless — for example `firewall_policy_list`, `system_status`, `monitor_vpn_ipsec` and `log_traffic_forward`
- Firewall gets 32 tools covering IPv4 and IPv6 policies, addresses and groups, services, VIPs, IP pools, schedules and sessions
- VPN gets 22 for IPsec Phase 1 and 2, SSL VPN portals and settings, and tunnel state; Router gets 17 for static routes, OSPF, BGP, RIP and SD-WAN health
- Security gets 29 across IPS, AV, webfilter, app control, DLP, email filter, DNS filter, WAF, ICAP and ZTNA
- 5 generic pass-through tools reach everything else — a CMDB family starting at `cmdb_list` that also gets, creates, updates and deletes any resource, plus `monitor_get`, `log_get` and `service_call`
- CMDB, Monitor, Log and Service API sections are all supported, and multi-VDOM environments work
Python 3.11 or higher with uv, and a FortiGate running FortiOS 7.6.x. Create a REST API Admin under System > Administrators and copy the token — it is shown once. Then set FORTIOS_HOST, FORTIOS_API_TOKEN, FORTIOS_VDOM and FORTIOS_VERIFY_SSL. It runs over stdio by default; `MCP_TRANSPORT=streamable-http MCP_PORT=8000` serves it remotely instead.