Content
**English** | [繁體中文](README.zh-TW.md)
# FortiGate MCP Setup for Claude Desktop
Manage and query your FortiGate firewall directly from Claude Desktop in natural language, via the [Model Context Protocol (MCP)](https://modelcontextprotocol.io).
This project is a **configuration template and setup guide** that helps you quickly connect a FortiGate MCP Server to Claude Desktop (macOS).
> ⚠️ This repository contains **no** real IPs, API tokens, or other secrets. Every value is a placeholder — fill in your own following the steps below.
---
## Features
Once connected, you can ask Claude in plain language, for example:
- "Show the FortiGate system status"
- "List all firewall policies — which ones are allow any?"
- "Which interfaces are in use, and how much traffic?"
- "Run a Security Rating check"
- "What are the access rules between VLANs?"
The underlying MCP Server exposes around **94+ tools**, covering system monitoring, firewall policies, routing, VPN, security profiles, wireless, switches, logs, and more.
---
## Prerequisites
| Item | Notes |
|------|-------|
| macOS | This guide uses macOS (Windows paths noted below) |
| [Claude Desktop](https://claude.ai/download) | Anthropic's official desktop app |
| [Node.js](https://nodejs.org) | Version **18 or later** (`node -v` to verify) |
| FortiGate | FortiOS **7.4 or later**, with REST API access |
---
## Installation
### 1. Create a FortiGate API Token
Log in to the FortiGate admin UI:
```
System → Administrators → Create New → REST API Admin
```
Recommended settings:
- **Administrator Profile**: create a `read-only` profile (least privilege); elevate temporarily only when you need to make changes
- **Trusted Hosts**: enter the IP of the machine running Claude Desktop (e.g. `192.168.1.100/32`) to restrict the API source
- After creating, **copy the token (shown only once!)**
### 2. Install the MCP Server
```bash
# Clone the FortiGate MCP Server of your choice (example)
git clone https://github.com/<your-fortigate-mcp-repo>.git
cd <fortigate-mcp>
# Install dependencies and build
npm install
npm run build
# Note the full path — you'll need it for the config
pwd
```
### 3. Configure environment variables
Copy the template and fill in your details:
```bash
cp .env.example .env
# Open .env in an editor and set your FortiGate IP and API Token
```
### 4. Configure Claude Desktop
Merge the `mcpServers` block from `claude_desktop_config.example.json` into your Claude Desktop config file:
- **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
- **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`
> If the config file already has content, only add the `mcpServers` key — do not overwrite the whole file.
Or run the included script (it backs up your existing config automatically):
```bash
./setup.sh
```
### 5. Restart Claude Desktop
```bash
# macOS
pkill -f "Claude" && sleep 2 && open -a Claude
```
### 6. Verify the connection
After restarting, click **`+` → Connectors** at the bottom-left of the Claude Desktop chat box.
You should see `fortigate` shown as enabled (blue).
Then just type "Show the FortiGate system status" to test.
---
## Usage
For more natural-language query examples and a tool category breakdown, see [docs/USAGE.md](docs/USAGE.md).
---
## Security Notes
- **Never** commit `.env` or a filled-in `claude_desktop_config.json` to Git (both are excluded in `.gitignore`)
- Treat the API Token like a password — if leaked, revoke and regenerate it on the FortiGate immediately
- For production, enable `FORTIGATE_VERIFY_SSL=true` and use a valid certificate
- Prefer a read-only API account to reduce the risk of accidental changes
---
## Troubleshooting
| Symptom | Possible cause |
|---------|----------------|
| Connectors doesn't show fortigate | Claude not fully restarted (use `Cmd+Q` on macOS), invalid JSON, or wrong path |
| Connects but queries fail | Wrong API Token or IP, or Trusted Hosts doesn't include your machine |
| Logs come back empty | Logs live on disk / FortiAnalyzer / FortiCloud, not in memory |
View MCP connection logs:
```bash
cat ~/Library/Logs/Claude/mcp*.log
```
---
## License
Released under the MIT License — feel free to modify and use.
FortiGate and FortiOS are trademarks of Fortinet, Inc. This project is not affiliated with Fortinet.
