Fortigate

You set up and run a FortiGate MCP Server to manage FortiGate devices programmatically using the Model Context Protocol. This server exposes an HTTP MCP transport for integration with MCP clients and tools, lets you manage devices, firewall rules, network objects, routing, and more, and supports Docker deployment for easy setup and operation.

How to use

Use an MCP client to send requests to the FortiGate MCP Server and perform common management tasks. You can start the HTTP MCP server and connect either via a URL (recommended for Cursor or other MCP clients) or by launching the server locally as a standard input/output process. With the server running, you can list devices, test connections, manage firewall rules, and handle network and routing objects through simple MCP commands.

How to install

Prerequisites: Python 3.8 or newer, access to a FortiGate device, and an API token or username/password for authentication.

1. Clone the project and navigate to the project folder.

git clone <repository-url>
cd fortigate-mcp-server

2. Create and activate a Python virtual environment, then install dependencies.

python -m venv .venv
source .venv/bin/activate  # Linux/Mac
# or
.venv\Scripts\activate  # Windows

pip install -r requirements.txt

3. Configure the server by editing the configuration file. The configuration includes FortiGate device connection details and logging settings.

{
  "fortigate": {
    "devices": {
      "default": {
        "host": "192.168.1.1",
        "port": 443,
        "username": "admin",
        "password": "password",
        "api_token": "your-api-token",
        "vdom": "root",
        "verify_ssl": false,
        "timeout": 30
      }
    }
  },
  "logging": {
    "level": "INFO",
    "file": "./logs/fortigate_mcp.log"
  }
}

4. Start the HTTP MCP server. You can run the server directly or use the provided startup script.

# Start with script
./start_http_server.sh

# Or start directly via Python
python -m src.fortigate_mcp.server_http \
  --host 0.0.0.0 \
  --port 8814 \
  --path /fortigate-mcp \
  --config config/config.json

5. (Optional) Run the server with Docker. If you prefer containerized deployment, you can build and run using Docker Compose and monitor logs with the usual Docker commands.

docker-compose up -d

# View logs
docker-compose logs -f fortigate-mcp-server

Configuration and ongoing usage

Configure your FortiGate connections in the config/config.json file. The configuration includes details such as host, port, authentication credentials, vdom, SSL verification, and timeouts. You can adjust the logging level and log file location in the same config.

Cursor and MCP client integration is supported. You can connect from Cursor either by launching the server as a subprocess or by pointing Cursor to the server URL. The recommended approach is to use the HTTP URL transport.

Troubleshooting and notes

Common issues include connectivity to the FortiGate device, SSL certificate validation, and port availability for the MCP HTTP server. Ensure the FortiGate device is reachable, the correct API token or credentials are in use, and the chosen port is open and not in use by another process.

If you encounter connection problems with Cursor, verify that the MCP server is running and that the URL is correct. Restart Cursor after starting the server.

The server supports health checks and basic API schema inquiries to help you diagnose issues.

Appendix: Cursor MCP integration examples

Two MCP connection options are shown: a command-based connection that runs the server locally and a URL-based connection that points Cursor to the running HTTP endpoint.

Available tools

list_devices

List registered FortiGate devices available to the MCP server.

get_device_status

Retrieve the current status of a connected FortiGate device.

test_device_connection

Test connectivity and authentication with a FortiGate device.

add_device

Add a new FortiGate device configuration to the MCP server.

remove_device

Remove an existing FortiGate device from the MCP server.

discover_vdoms

Discover available VDOMs on a FortiGate device.

list_firewall_policies

List firewall policies configured on FortiGate.

create_firewall_policy

Create a new firewall policy on FortiGate.

update_firewall_policy

Update an existing firewall policy.

delete_firewall_policy

Delete a firewall policy.

list_address_objects

List address objects configured on FortiGate.

create_address_object

Create a new address object on FortiGate.

list_service_objects

List service objects configured on FortiGate.

create_service_object

Create a new service object on FortiGate.

list_virtual_ips

List virtual IP objects configured on FortiGate.

create_virtual_ip

Create a new virtual IP on FortiGate.

update_virtual_ip

Update an existing virtual IP on FortiGate.

get_virtual_ip_detail

Get details for a specific virtual IP.

delete_virtual_ip

Delete a virtual IP from FortiGate.

list_static_routes

List static routes configured on FortiGate.

create_static_route

Create a new static route.

update_static_route

Update an existing static route.

delete_static_route

Delete a static route.

get_static_route_detail

Get details of a static route.

get_routing_table

Retrieve the current routing table.

list_interfaces

List network interfaces on FortiGate.

get_interface_status

Get the status of a specific interface.

health

Perform a health check of the MCP server and connected devices.

test_connection

Test the MCP connection to FortiGate devices and MCP transport.

get_schema_info

Retrieve the schema information for MCP methods.