LabscoMCP early access ↗
paoloamato2MCP SERVER

Fortinet MCP Server

Ask a FortiGate about its policies, tunnels, routes and logs — and reach any of its 1,536 REST endpoints when the typed tools stop short.

by paoloamato2 ↗Network, Endpoint & Fleet ManagementCommunity

LABSCO SUMMARY

Typed tools for the common work, a pass-through for everything else.

That pairing is what keeps this usable. The typed tools give the model good arguments for the questions people actually ask, and when someone needs an endpoint nobody wrapped, cmdb_list takes the raw resource path instead of returning nothing. Set FORTIOS_VERIFY_SSL=true in production, and remember the API token carries exactly the privileges of the admin profile behind it — a read-only profile is the right start.

What it is

A FortiOS 7.6.x server. It exposes the FortiGate REST API as typed MCP tools organised by functional area, and backs them with generic pass-through tools that cover the rest of the API.

What you get

  • The README counts 204+ typed tools across system, firewall, VPN, router, user, monitor, log, security and wireless, but names only a few of them — firewall_policy_list, system_status, monitor_vpn_ipsec and log_traffic_forward among them
  • Firewall gets 32 tools covering IPv4 and IPv6 policies, addresses and groups, services, VIPs, IP pools, schedules and sessions
  • VPN gets 22 for IPsec Phase 1 and 2, SSL VPN portals and settings, and tunnel state; Router gets 17 for static routes, OSPF, BGP, RIP and SD-WAN health
  • Security gets 29 across IPS, AV, webfilter, app control, DLP, email filter, DNS filter, WAF, ICAP and ZTNA
  • 5 generic pass-through tools reach everything else — a CMDB family starting at cmdb_list that also gets, creates, updates and deletes any resource, plus monitor_get, log_get and service_call
  • CMDB, Monitor, Log and Service API sections are all supported, and multi-VDOM environments work

Requirements

Python 3.11 or higher with uv, and a FortiGate running FortiOS 7.6.x. Create a REST API Admin under System > Administrators and copy the token — it is shown once. Then set FORTIOS_HOST, FORTIOS_API_TOKEN, FORTIOS_VDOM and FORTIOS_VERIFY_SSL. It runs over stdio by default; MCP_TRANSPORT=streamable-http MCP_PORT=8000 serves it remotely instead.

Setup effort

Build from source — git clone https://github.com/paoloamato2/fortinet-mcp-server.git

See installation options