Michael Pope
Open Source PAN-OS MCP Server

The Node804 PAN-OS MCP Server is an open-source Model Context Protocol server for Palo Alto Networks PAN-OS firewalls and Panorama. It gives AI assistants a safer way to inspect, troubleshoot, summarize, and, when explicitly enabled, modify firewall and Panorama configuration.

The project is built for real network and security operations, where response size, access control, auditability, and TLS behavior matter as much as feature coverage.

Why I Built It

Firewall and Panorama APIs expose extremely valuable operational data, but they also create obvious risk if an assistant receives broad access without guardrails. I wanted an MCP server that could help with practical security operations while respecting the principle of least privilege.

This project was built around three engineering priorities:

  • Lean responses by default so the assistant receives the fields needed to answer the question, not huge API dumps
  • Default-deny RBAC so read-only inspection is the baseline and write/admin behavior requires explicit opt-in
  • TLS verification on by default so secure transport is the expected posture, not an optional afterthought

The result is an open-source MCP server that can support daily firewall troubleshooting while still being disciplined about permissions and operational safety.

Open Source Design

The server is published openly under the MIT license so network engineers, security teams, and MCP builders can inspect how it works and adapt it for their environments. The repository includes source code, tests, CI, documentation, setup examples, and packaging.

Open source matters here because this type of software is security-adjacent. If a tool can inspect or change firewall configuration, the implementation should be transparent. Users should be able to review the permission model, understand which tools are exposed in each mode, and validate how sensitive operations are guarded.

Permission Modes

The server uses PANOS_MODE to decide which tools are registered:

  • read: read-only inspection, troubleshooting, policy/NAT matching, route lookup, rule hit counts, config diff, and summaries
  • standard: read access plus object and tag CRUD
  • full: policy rule CRUD, static routes, NAT, security, PBF, QoS, decryption, and Panorama pre/post rules
  • admin: full access plus commit, push, revert, and raw API escape hatches

Tools above the active mode are not registered with the MCP server. That means the LLM cannot invoke higher-risk actions unless the operator intentionally exposes them.

Token-Efficient Operations

One of the strongest parts of this project is its focus on token efficiency. Firewall and Panorama APIs can return large configuration objects, and naively dumping them into an LLM context is expensive and noisy.

The server addresses this through:

  • Lean default field sets
  • Optional verbose responses
  • Explicit field projection
  • Pagination controls
  • Pattern filtering
  • Summary tools for common audit and troubleshooting questions

The README documents benchmark examples where summarized or filtered tools reduce token usage dramatically compared with dumping full objects into context.

What It Can Do

The server exposes broad operational coverage across PAN-OS and Panorama:

  • System and server status
  • Diagnostics and troubleshooting
  • Network, routing, sessions, and interfaces
  • Security policy, NAT, objects, tags, and certificates
  • Panorama device groups and templates
  • Logs, threats, licenses, VPN, User-ID, and admin surfaces
  • Aggregation and summary tools for faster inspection

In read mode, it supports live troubleshooting without enabling writes. In higher modes, it can support controlled configuration changes while keeping commits and raw operations gated behind the administrative tier.

Security Posture

The security model is intentionally conservative:

  • Default mode is read-only
  • Writes go to candidate configuration and do not affect live policy without commit
  • Commit and push operations require admin mode
  • Raw config and raw operational commands are disabled unless explicitly enabled
  • TLS verification is on by default
  • Self-signed or internal CA environments require explicit configuration
  • Audit logging can capture tool calls with sanitized arguments

This makes the server suitable for cautious adoption: start with inspection and troubleshooting, then selectively enable broader capability only where the operational model justifies it.

Practical Impact

For infrastructure and security teams, this server turns AI into a more useful firewall operations assistant. It can help answer questions like:

  • “What is my access level?”
  • “What firewalls are configured?”
  • “Summarize the security policy.”
  • “Find rules matching this pattern.”
  • “Check whether this source/destination would match a policy or NAT rule.”
  • “Show rule hit counts.”
  • “Compare candidate and running configuration.”

Those workflows are valuable because they reduce the time spent clicking through administrative interfaces or copying large XML/API responses into separate tools.