PAN-OS MCP Server

What is PAN-OS MCP Server?

An MCP server for managing Palo Alto Networks firewalls via the XML API. It lets Claude or other compatible tools interact with PAN-OS devices using natural language commands.

How to use PAN-OS MCP Server?

Clone the repository, install dependencies with pip install -r requirements.txt, add the server to your Claude Desktop configuration, and edit pan-os.py to set your firewall host and API key. Once configured, tools such as get_system_info, op_command, commit_config, commit_all_shared_policy, and config_action become available.

Key features of PAN-OS MCP Server

• Authenticate with a PAN-OS/Panorama device using an API key
• Retrieve system information from the firewall
• Execute operational commands via XML
• Commit candidate configurations
• Perform configuration actions (set, edit, delete, rename)
• Push policy from Panorama to managed devices

Use cases of PAN-OS MCP Server

• Manage firewall settings through conversational AI interfaces
• Automate configuration commits and policy pushes across multiple devices
• Query live operational state without logging into the web UI
• Script bulk configuration changes using natural language instructions

FAQ from PAN-OS MCP Server

What are the requirements to run the server?

Python 3.13+, a Palo Alto Networks firewall, and API access to the PAN-OS device.

How do I authenticate with my firewall?

Edit the pan-os.py file and provide your firewall host IP and API key in the PA_HOST and PA_API_KEY variables.

Is this server production-ready?

The README states it is designed for demonstration and use in controlled environments. It recommends adding TLS verification and keeping the API key secure before any production use.

What commands are available?

The server provides five tools: get_system_info, op_command, commit_config, commit_all_shared_policy, and config_action.

How should I handle the API key securely?

Do not commit the API key to public repositories. For production, ensure proper authentication controls and consider adding TLS verification.