fortigate-mcp-server
★ View on GitHub
MCP Server · Fortinet FortiOS

Configure a FortiGate through Claude.
Nothing changes without a preview.

An MCP server that takes a FortiGate from factory defaults to production-ready — bootstrap, VDOMs, routing, firewall policy, VPN, compliance analysis — through natural conversation with an AI assistant. Every mutation returns a diff first; nothing is ever applied blind.

View source on GitHub → See what it covers
115 tools 548 tests passing Python 3.12+ MCP 1.0 MIT license
claude · fortigate-mcp
In action

One prompt, fully previewed in the backend

What you type into Claude on the left is exactly what runs as MCP tool calls on the right — nothing is applied until you confirm it.

Claude ↔ fortigate-mcp
MCP tool calls
Design

Three ideas most FortiGate tooling skips

Built around three principles that rarely appear together in one tool.

01

Nothing mutates without a preview

Every create, update, or delete call returns a diff and a change_id instead of executing. A separate change_apply call runs it — and re-checks live state for drift first. There's no single-shot mode, even for trusted automation.

02

Claude never sees a real credential

Device passwords and API tokens are provisioned locally via fortinet-mcp-cred, straight into your OS credential store. The tool surface only ever handles an opaque credential_id.

03

The whole lifecycle, not just policy CRUD

Bootstrap, VDOM multi-tenancy, interfaces, routing, firewall policy, IPsec/SSL VPN, compliance analysis, and documentation generation — all first-class tool namespaces.

Coverage

One inventory, dozens of devices, every domain

A Customer → Site → Device → VDOM hierarchy in a local SQLite store — resolve a device by name, never by typing an IP into a prompt.

Inventory & multi-tenancy
Customer → Site → Device → VDOM hierarchy, resolved by name, site, customer, or IP.
Device bootstrap
DNS, NTP, syslog, SNMP, global settings, local admin accounts, HA — factory defaults to production-ready.
VDOM lifecycle
Create and delete VDOMs, create and delete inter-VDOM links.
Network topology
Interfaces (VLAN sub-interfaces, loopbacks, vdom-link members), zones, DHCP servers, static routes.
Firewall & NAT
Policies, address/service objects, virtual IPs — full CRUD, always previewed.
VPN
IPsec site-to-site tunnels (phase1/phase2) with live status; SSL VPN visibility.
Analysis & compliance
Duplicate/shadowed/any-any policy detection, unused objects, subnet overlap, best-practice checks, a 0–100 security score.
Documentation
Topology diagrams (Mermaid/drawio/PlantUML), policy/routing/VPN/system-config Markdown, combined export.
Architecture

Seven layers, one direction

Dependencies only flow downward. FortinetProductAdapter is the only extensibility boundary — adding another Fortinet product means one new adapter, nothing above it changes.

01MCP Tool Layerinventory · policy · vpn · analysis · intent · change
↓
02Service Layerone service per capability, mode enforcement
↓
03Domain / Analysis Enginespure functions — DiffEngine, policy analyzers, scoring
↓
04Repository Layerinventory, change and snapshot persistence
↓
05Vendor Adapter LayerFortinetProductAdapter protocol — the plugin boundary
↓
06Vendor API ClientFortiOSRestClient — persistent per-device connection
↓
07InfraConnectionManager, CredentialManager (keyring), SQLite
Operating modes

Set once, enforced everywhere

Set via FORTINET_MCP_MODE, default full.

READ_ONLY

No mutation may even be previewed.

SAFE

Delete operations are rejected; create/update still require preview → apply.

FULL

Every operation is allowed, but still requires preview → apply — there is no single-shot fast path in any mode.

Security model

Credentials never pass through the conversation

→

inventory_register_device_pending only collects metadata (host, name, customer, site) and mints an opaque credential_id. The actual secret is entered once, locally, via fortinet-mcp-cred set, straight into the OS credential store.

→

Any tool needing a live session fails with a clear "credential not provisioned" error until that step is done — there's no fallback path that lets a secret flow through MCP.

→

Two documented exceptions, flagged in their tool descriptions: an IPsec tunnel's PSK and a local admin account's password — because FortiOS itself never returns them on GET.

115
MCP tools
548
tests, no live device needed
7
architecture layers
3
operating modes
Get started

Clone it, point Claude at it, register your first device.

MIT licensed. Verified end-to-end against a mocked FortiOS REST API — real-device quirks welcome as issues.

github.com/Serrinho02/fortigate-mcp-server →