Fortinet MCP for Fortinet: safety score

D 43 Provisional Not reviewed Not tested read-only mode

Fortinet MCP is a community MCP server for Fortinet. OpsMCP did not extract a tool list, so whether it can read, write, or delete is unknown. It has a read-only mode and needs to run locally and a secret in an environment variable; its provisional OpsMCP grade is D (43%), last checked 16 Oct 2026.

Last checked 16 Oct 2026.

Audit every client FortiGate for firmware, SSL-VPN exposure, admin accounts and license expiry.

Publisher's description

io.github.Servosity/fortinet-mcp · version 0.1.1

Tool capability not scored. Access partly scored. Publisher partly scored. 1 of 4 factors scored.

Not hands-on tested. No test date, notes, or observed write behavior.

Fortinet GitHub Registry record Report this listing

Can it change or delete things?

Unknown. OpsMCP did not extract a tool list, so this page cannot say whether the server can change or delete anything.

Score

43 of 100 points (43%). A factor that was not scored counts as 0 of its full weight.

OpsMCP rubric 2026-10-16.3. Checked 16 Oct 2026.
Factor	Points	Full weight	Status
Tool capability	unknown	35	Not scored
Access	12	25	Partly scored
Maintenance	20	20	Scored
Publisher	11	20	Partly scored

Tool capability

Tools unknown.

Environment variable FORTINET_MCP_READ_ONLY (default unset). View the repository.

Access

Part	Value	Points	Where this came from
Scope	unknown	unknown	unknown
Where it runs	Local process	6 of 8	Registry package transport is stdio.
Credentials	Secret in an environment variable	6 of 7	Registry marked isSecret true for FORTINET_API_TOKEN, FORTINET_FMG_API_KEY, FORTINET_CLOUD_API_PASSWORD, FORTINET_MCP_HTTP_TOKEN

Maintenance

Part	Value	Points
Last commit	0 days	8 of 8
Releases	0 days	6 of 6
Issues	80 closed / 83 issues (0.96)	6 of 6

Publisher

Part	Value	Points	Where this came from
Who publishes it	Organization	5 of 8	GitHub owner type is Organization (Servosity). Not on the vendor allowlist.
Registry listing	Listed	5 of 5	Official registry server io.github.Servosity/fortinet-mcp (status active).
License	License not identified	unknown	License not identified. GitHub SPDX is NOASSERTION: a license file exists that GitHub cannot identify.
Stars	59	1 of 2	59 GitHub stars.
Repository age	143 days	0 of 1	Repository created 2026-05-26T14:14:21Z.

How the rubric works

What this score does not cover

This score is not a code audit and it is not a human review. It has not been hands-on tested. Nothing on this page is a certification.

Access needed

Variable	Required	Secret	Default	Description
`FORTINET_BASE_URL`	yes	unknown	unset	Your FortiGate's REST API root, e.g. https://203.0.113.10:8443/api/v2.
`FORTINET_API_TOKEN`	yes	yes	unset	The FortiGate REST API admin token (System > Administrators > Create New > REST API Admin). Use a read-only admin profile.
`FORTINET_DEVICES`	unknown	unknown	unset	Optional. Path to a devices.toml listing every FortiGate the fleet, audit and policies hygiene commands check, each with a token_file. Leave blank to check only the FortiGate above.
`FORTINET_FMG_URL`	unknown	unknown	unset	Optional. https://<fortimanager> for the read-only fmg commands. Leave blank if you do not use FortiManager.
`FORTINET_FMG_API_KEY`	unknown	yes	unset	Optional. API key of a FortiManager REST API admin (FortiManager 7.2.2 or later) for the fmg commands.
`FORTINET_CLOUD_API_USER`	unknown	unknown	unset	Optional. FortiCloud IAM API user (with FortiGate Cloud portal permission) for the read-only cloud commands.
`FORTINET_CLOUD_API_PASSWORD`	unknown	yes	unset	Optional. Password of the FortiCloud IAM API user. Repeated failed logins lock the FortiCloud account for 15-30 minutes.
`FORTINET_CLOUD_REGION`	unknown	unknown	unset	Optional. global (default), us, eu or jp: the region your FortiGates were provisioned in.
`FORTINET_CLOUD_ACCOUNT_ID`	unknown	unknown	unset	Optional. Required only when FortiCloud Organizations are enabled.
`FORTINET_MCP_READ_ONLY`	unknown	unknown	unset	Optional. Set to 1 to expose only read-only mirrored tools and refuse any non-GET execute call.
`FORTINET_MCP_HTTP_TOKEN`	unknown	yes	unset	Required only when running the MCP server with --transport http (a remote/hosted deployment); callers must send a matching Authorization: Bearer header. Not needed for the default local stdio transport Claude Desktop uses.
`FORTINET_USER_AGENT`	unknown	unknown	unset	Optional. Overrides the User-Agent the CLI sends to your FortiGates. Leave blank to use the built-in one.
`PRINTING_PRESS_CLIENT_PROFILE`	unknown	yes	unset	Only used when the MCP server is bound to a tenant-gated client profile. This connector registers no tenant-gated source, so leave it blank.

Maintenance

Archived: no
Last commit: 16 Oct 2026 · cd866c9
Latest release: zammad-v0.1.8 · 16 Oct 2026
Issues: 3 open · 80 closed
Stars: 59
License: License not identified
Repository created: 26 May 2026

npm and PyPI

npm: No npm package in the registry entry.
PyPI: No PyPI package in the registry entry.
Maintainers: unknown

Install

Source: registry. This is the published command, not a rewritten one.

# requires FORTINET_BASE_URL: Your FortiGate's REST API root, e.g. https://203.0.113.10:8443/api/v2.
# requires FORTINET_API_TOKEN: The FortiGate REST API admin token (System > Administrators > Create New > REST API Admin). Use a read-only admin profile.
# mcpb package https://github.com/Servosity/msp-skills/releases/download/fortinet-v0.1.1/fortinet-mcp.mcpb version 0.1.1

Other Fortinet servers

fortigate-mcp-server by alpadalar

Badge

The SVG is generated for this server. The embed links to this server page.

Embed snippet

[![OpsMCP D provisional](https://opsmcp.dev/badge/servosity-fortinet-mcp.svg)](https://opsmcp.dev/servers/servosity-fortinet-mcp/)

Sources for this listing

registry:fortinet

Official registry server io.github.Servosity/fortinet-mcp (status active).