checkpoint-waf-mcp

# Check Point CloudGuard WAF MCP Server A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that wraps the Check Point CloudGuard WAF Management GraphQL API. This gives AI assistants like Claude the ability to manage your CloudGuard WAF configuration through natural language. ## What It Does This MCP server exposes **68 tools** that let an AI assistant fully manage your CloudGuard WAF deployment: | Category | Tools | What You Can Do | |----------|-------|-----------------| | **Assets** | 9 | Create, update, delete Web Application and Web API assets | | **Profiles** | 14 | Manage Docker, Kubernetes, Embedded, and AppSec Gateway deployment profiles | | **Practices** | 10 | Configure Web Application and Web API security practices (IPS, WebAttacks, WebBot, etc.) | | **Behaviors** | 10 | Manage exceptions, trusted sources, and web user response behaviors | | **Zones** | 5 | Create and manage security zones | | **Triggers** | 6 | Configure log triggers with syslog, CEF, cloud, and agent logging | | **Policy** | 9 | Publish changes, enforce policy, view threat prevention policy | | **Agents** | 3 | List agents, revoke access, trigger upgrades | ## Prerequisites - **Python 3.10+** - **Check Point Infinity Portal account** with CloudGuard WAF enabled - **API credentials** (Client ID and Secret Key) from the Infinity Portal ## Installation ### Using uv (recommended) ```bash # Clone the repo git clone https://github.com/presidentsu/checkpoint-waf-mcp.git cd checkpoint-waf-mcp # Create venv and install uv venv uv pip install -e . ``` ### Using pip ```bash git clone https://github.com/presidentsu/checkpoint-waf-mcp.git cd checkpoint-waf-mcp python -m venv .venv source .venv/bin/activate # On Windows: .venv\Scripts\activate pip install -e . ``` ## Configuration ### 1. Get API Credentials 1. Log in to the [Check Point Infinity Portal](https://portal.checkpoint.com) 2. Go to **Settings > API Keys** 3. Create a new API key with CloudGuard WAF permissions 4. Note your **Client ID** and **Secret Key** ### 2. Set Environment Variables ```bash export CHECKPOINT_CLIENT_ID="your-client-id" export CHECKPOINT_SECRET_KEY="your-secret-key" export CHECKPOINT_REGION="us" # Options: us, eu, india, australia ``` Or copy `.env.example` to `.env` and fill in your values. ### 3. Connect to Your MCP Client #### Claude Desktop Add to your `claude_desktop_config.json`: ```json { "mcpServers": { "checkpoint-waf": { "command": "uv", "args": [ "--directory", "/path/to/checkpoint-waf-mcp", "run", "checkpoint-waf-mcp" ], "env": { "CHECKPOINT_CLIENT_ID": "your-client-id", "CHECKPOINT_SECRET_KEY": "your-secret-key", "CHECKPOINT_REGION": "us" } } } } ``` #### Claude Code (CLI) Add to your `.claude/settings.json`: ```json { "mcpServers": { "checkpoint-waf": { "command": "uv", "args": [ "--directory", "/path/to/checkpoint-waf-mcp", "run", "checkpoint-waf-mcp" ], "env": { "CHECKPOINT_CLIENT_ID": "your-client-id", "CHECKPOINT_SECRET_KEY": "your-secret-key", "CHECKPOINT_REGION": "us" } } } } ``` ## Supported Regions | Region | Endpoint | |--------|----------| | `us` (default) | `cloudinfra-gw-us.portal.checkpoint.com` | | `eu` | `cloudinfra-gw.portal.checkpoint.com` | | `india` | `cloudinfra-gw.in.portal.checkpoint.com` | | `australia` | `cloudinfra-gw.au.portal.checkpoint.com` | ## Usage Examples Once connected, you can ask your AI assistant things like: - *"List all my WAF assets"* - *"Create a new Web Application asset called 'prod-app' with upstream URL http://10.0.0.1"* - *"Show me the security practices attached to asset X"* - *"Switch the IPS practice to Prevent mode"* - *"Create a log trigger that sends to my syslog server at 192.168.1.100"* - *"Publish and enforce the current policy"* - *"What agents are connected to the production profile?"* ## Architecture ``` src/checkpoint_waf_mcp/ ├── __main__.py # Entry point ├── config.py # Region endpoints & env var loading ├── auth.py # Token auth with auto-refresh ├── graphql_client.py # Async GraphQL client with retry ├── server.py # FastMCP server & tool registration ├── queries/ # GraphQL query/mutation definitions │ ├── assets.py │ ├── profiles.py │ ├── practices.py │ ├── behaviors.py │ ├── zones.py │ ├── triggers.py │ ├── policy.py │ └── utility.py └── tools/ # MCP tool implementations ├── assets.py ├── profiles.py ├── practices.py ├── behaviors.py ├── zones.py ├── triggers.py ├── policy.py └── agents.py ``` ## License Apache 2.0 - see [LICENSE](LICENSE) for details.