Check Point CloudGuard WAF Server

A Model Context Protocol (MCP) server that wraps the Check Point CloudGuard WAF Management GraphQL API. This gives AI assistants like Claude the ability to manage your CloudGuard WAF configuration through natural language.

What It Does

This MCP server exposes 68 tools that let an AI assistant fully manage your CloudGuard WAF deployment:

Category	Tools	What You Can Do
Assets	9	Create, update, delete Web Application and Web API assets
Profiles	14	Manage Docker, Kubernetes, Embedded, and AppSec Gateway deployment profiles
Practices	10	Configure Web Application and Web API security practices (IPS, WebAttacks, WebBot, etc.)
Behaviors	10	Manage exceptions, trusted sources, and web user response behaviors
Zones	5	Create and manage security zones
Triggers	6	Configure log triggers with syslog, CEF, cloud, and agent logging
Policy	9	Publish changes, enforce policy, view threat prevention policy
Agents	3	List agents, revoke access, trigger upgrades

Prerequisites

• Python 3.10+
• Check Point Infinity Portal account with CloudGuard WAF enabled
• API credentials (Client ID and Secret Key) from the Infinity Portal

Installation

Using uv (recommended)

# Clone the repo
git clone https://github.com/presidentsu/checkpoint-waf-mcp.git
cd checkpoint-waf-mcp

# Create venv and install
uv venv
uv pip install -e .

Using pip

git clone https://github.com/presidentsu/checkpoint-waf-mcp.git
cd checkpoint-waf-mcp

python -m venv .venv
source .venv/bin/activate   # On Windows: .venv\Scripts\activate
pip install -e .

Configuration

1. Get API Credentials

1. Log in to the Check Point Infinity Portal
2. Go to Settings > API Keys
3. Create a new API key with CloudGuard WAF permissions
4. Note your Client ID and Secret Key

2. Set Environment Variables

export CHECKPOINT_CLIENT_ID="your-client-id"
export CHECKPOINT_SECRET_KEY="your-secret-key"
export CHECKPOINT_REGION="us"  # Options: us, eu, india, australia

Or copy .env.example to .env and fill in your values.

3. Connect to Your MCP Client

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "checkpoint-waf": {
      "command": "uv",
      "args": [
        "--directory", "/path/to/checkpoint-waf-mcp",
        "run", "checkpoint-waf-mcp"
      ],
      "env": {
        "CHECKPOINT_CLIENT_ID": "your-client-id",
        "CHECKPOINT_SECRET_KEY": "your-secret-key",
        "CHECKPOINT_REGION": "us"
      }
    }
  }
}

Claude Code (CLI)

Add to your .claude/settings.json:

{
  "mcpServers": {
    "checkpoint-waf": {
      "command": "uv",
      "args": [
        "--directory", "/path/to/checkpoint-waf-mcp",
        "run", "checkpoint-waf-mcp"
      ],
      "env": {
        "CHECKPOINT_CLIENT_ID": "your-client-id",
        "CHECKPOINT_SECRET_KEY": "your-secret-key",
        "CHECKPOINT_REGION": "us"
      }
    }
  }
}

Supported Regions

Region	Endpoint
us (default)	cloudinfra-gw-us.portal.checkpoint.com
eu	cloudinfra-gw.portal.checkpoint.com
india	cloudinfra-gw.in.portal.checkpoint.com
australia	cloudinfra-gw.au.portal.checkpoint.com

Usage Examples

Once connected, you can ask your AI assistant things like:

• "List all my WAF assets"
• "Create a new Web Application asset called 'prod-app' with upstream URL http://10.0.0.1"
• "Show me the security practices attached to asset X"
• "Switch the IPS practice to Prevent mode"
• "Create a log trigger that sends to my syslog server at 192.168.1.100"
• "Publish and enforce the current policy"
• "What agents are connected to the production profile?"

Architecture

src/checkpoint_waf_mcp/
├── __main__.py          # Entry point
├── config.py            # Region endpoints & env var loading
├── auth.py              # Token auth with auto-refresh
├── graphql_client.py    # Async GraphQL client with retry
├── server.py            # FastMCP server & tool registration
├── queries/             # GraphQL query/mutation definitions
│   ├── assets.py
│   ├── profiles.py
│   ├── practices.py
│   ├── behaviors.py
│   ├── zones.py
│   ├── triggers.py
│   ├── policy.py
│   └── utility.py
└── tools/               # MCP tool implementations
    ├── assets.py
    ├── profiles.py
    ├── practices.py
    ├── behaviors.py
    ├── zones.py
    ├── triggers.py
    ├── policy.py
    └── agents.py

License

Apache 2.0 - see LICENSE for details.