WatchGuard MCP — Claude Code MCP server: WatchGuard APIs in one CLI
Puts the WatchGuard Cloud APIs — Firebox, Endpoint Security, ThreatSync, NDR, AuthPoint — behind one CLI and MCP server. Built for providers juggling several customers.
Open on GitHubWhat WatchGuard MCP does
The server exposes WatchGuard Cloud platform APIs to your agent: Firebox, FireCloud, Endpoint Security, ThreatSync, NDR, AuthPoint and account endpoints. Reports can span several customers at once, which is the point for service providers. Everything runs on your own laptop and needs no coding.
The installer places two binaries in your user bin path: watchguard-cli and watchguard-mcp. Claude, Codex and Cowork pick up the skill from SKILL.md. Check the install with watchguard-cli --version.
One hard limit: do not start HTTP mode (--transport http), not even on localhost. This build validates a token, yet request size and time limits are missing, and the MCP tools can change settings with your credentials. Stay on the default stdio transport. If you opened a tunnel for a remote agent, take it down. That is also why ChatGPT, Microsoft 365 Copilot and the Gemini app are waiting on a reissued connector.
What it helps with
- pull a report across several WatchGuard customers at once
- check Firebox status through the agent instead of the web console
- review ThreatSync and NDR events for every account
- inspect AuthPoint access from the command line
- wire the WatchGuard API into Claude without writing code
Example prompts for the agent
- Give me a Firebox summary for all customers over the past week
- List AuthPoint events for this account from the last day
How to install WatchGuard MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about WatchGuard MCP
How do I install WatchGuard MCP in Claude Code?
Add the marketplace with /plugin marketplace add Servosity/msp-skills, then run /plugin install watchguard@msp-skills. After that, authenticate as described in the README and explore with watchguard-cli --help.
What does WatchGuard MCP do?
It gives your agent access to the WatchGuard Cloud APIs: Firebox, FireCloud, Endpoint Security, ThreatSync, NDR, AuthPoint and platform accounts. Reports can cover several customers in one pass.
Why is HTTP mode off limits?
This build checks a token but lacks request size and time limits, and the MCP tools can modify settings under your credentials. Use stdio instead, and shut down any tunnel you set up for a remote agent.
