# WatchGuard MCP

Puts the WatchGuard Cloud APIs — Firebox, Endpoint Security, ThreatSync, NDR, AuthPoint — behind one CLI and MCP server. Built for providers juggling several customers.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 62
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/watchguard
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/watchguard-mcp

## What it does

The server exposes WatchGuard Cloud platform APIs to your agent: Firebox, FireCloud, Endpoint Security, ThreatSync, NDR, AuthPoint and account endpoints. Reports can span several customers at once, which is the point for service providers. Everything runs on your own laptop and needs no coding.

The installer places two binaries in your user bin path: `watchguard-cli` and `watchguard-mcp`. Claude, Codex and Cowork pick up the skill from `SKILL.md`. Check the install with `watchguard-cli --version`.

One hard limit: do not start HTTP mode (`--transport http`), not even on localhost. This build validates a token, yet request size and time limits are missing, and the MCP tools can change settings with your credentials. Stay on the default stdio transport. If you opened a tunnel for a remote agent, take it down. That is also why ChatGPT, Microsoft 365 Copilot and the Gemini app are waiting on a reissued connector.

## Requirements
- Environment variables: `WATCHGUARD_CLIENT_ID`, `WATCHGUARD_CLIENT_SECRET`, `WATCHGUARD_API_KEY`, `WATCHGUARD_ACCOUNT_ID`, `WATCHGUARD_BASE_URL`, `WATCHGUARD_TOKEN_URL`, `WATCHGUARD_AUDIENCE`, `WATCHGUARD_OAUTH_SCOPE`, `WATCHGUARD_USER_AGENT`, `WATCHGUARD_MCP_READ_ONLY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- pull a report across several WatchGuard customers at once
- check Firebox status through the agent instead of the web console
- review ThreatSync and NDR events for every account
- inspect AuthPoint access from the command line
- wire the WatchGuard API into Claude without writing code

## Example prompts
- Give me a Firebox summary for all customers over the past week
- List AuthPoint events for this account from the last day

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 32 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md