synitio/forti-intelligence repository overview

⁠Forti Intelligence MCP server

Forti Intelligence is an open-source, self-hosted Model Context Protocol (MCP) server that connects your AI assistant to FortiManager and optional FortiAnalyzer. Investigate Fortinet networks in plain language, using inventory, routing, firewall policies, inspection settings, current device state, and event logs as evidence.

⁠What it helps you do

• Troubleshoot connectivity: follow a configured traffic path across managed FortiGates, inspect policy decisions, identify candidate NAT translations, and correlate incident logs.
• Explain website blocks: check FortiGuard categories, URL-specific overrides, web-filter decisions, and SSL/SSH inspection settings.
• Find the right firewall: resolve an IP address to scoped interface and zone candidates, devices, VDOMs, and ADOMs.
• Compare configuration with current behavior: inspect live policy matches, sessions, policy hits, package installation state, and available revision details.
• Investigate operational issues: inspect VPN, HA, dynamic-routing, SD-WAN, address ownership, and logging evidence.
• Correlate incidents: search FortiAnalyzer traffic and security logs using the flow and incident time.

⁠One endpoint for your managed FortiGates

The MCP host connects to FortiManager and, optionally, FortiAnalyzer over their JSON-RPC APIs. Multiple appliance profiles and scoped ADOM access let one MCP endpoint support investigations across multiple managed FortiGates.

The MCP host requires no direct FortiGate connectivity or FortiGate API credentials, including for URL rating. FortiManager supplies stored configuration and proxies current device reads and rating requests. Live reads require FortiManager to reach the selected FortiGate; URL rating also requires that FortiGate to obtain a FortiGuard answer. FortiAnalyzer supplies already collected logs.

⁠From a question to an answer with evidence

Ask your assistant, for example:

Use the example SYSTEM.md instructions⁠ to guide scope discovery, per-hop checks, incident correlation, and reporting. The visual investigation guide⁠ shows how these capabilities work together.

Expect findings supported by configuration, current reads, or recorded events, with confidence, freshness, and limits stated. Tools support diagnosis and recommendations; administrators retain control of configuration changes.

⁠Run in your environment

Container releases support Linux AMD64 and ARM64. The image starts Streamable HTTP on port 8080 by default; stdio is also supported. Supply your appliance configuration and credentials, and configure a bearer token for HTTP access. An MCP-compatible client connects your chosen assistant to the server.

Follow the configuration and deployment guide⁠ for setup, permissions, private CAs, and client connections. See the tool reference⁠ for all 29 tools and their inputs and limits.

⁠Source and community

• GitHub repository⁠: source code, documentation, issues, and contributions.
• synit.io Discord community⁠: join the community to discuss use cases and share feedback.

Licensed under Apache 2.0⁠.