WatchGuard Cloud MCP Server

Read-only MCP server for the WatchGuard Cloud public API, built for Service Provider (MSP) accounts. Enumerates managed client accounts, lists the Firebox estate, checks licence health, pulls Security/Executive Dashboard reports per client, detects silent devices, and reconciles MSSP Command billing exports.

Tools

| Tool | Purpose | |---|---| | wg_list_accounts | List managed client accounts (ID + name), optional name filter | | wg_list_fireboxes | Firebox inventory across all clients: serial, MAC, model, friendly name, account, licence expiry. resource_type also accepts accessPoint, authPoint, endPoint, fireboxRetention | | wg_licence_health | Flag devices whose licence has expired — under the monthly-rolling MSSP programme this means the device dropped off billing (decommissioned but still allocated, or a protection/billing gap) | | wg_security_report | Security Dashboard for one client: top blocked malware, botnet sites, attacks, countries, applications, URL categories | | wg_executive_report | Executive Dashboard for one client: top countries, clients, domains, destinations, applications, protocols | | wg_activity_check | Sweep all managed accounts and flag those with no Firebox log data in a recent window (default 48h) — the closest public-API proxy for device connectivity. Account-level: one active device masks a silent sibling. A silent account containing a current-licence device is the case to investigate | | wg_mssp_reconcile | Reconcile an MSSP Command "Network Security" CSV export (the only source of per-device service tier and points) against the Cloud inventory: flags devices consuming points but unallocated, and allocated devices absent from MSSP billing | | wg_api_call | Raw GET to any /rest/... endpoint, optionally with a token scoped to a managed account |

Tool outputs include monitorUrl/configureUrl deep links into the WatchGuard Cloud console for each account, because live device status (online/offline, firmware version) has no public API and is only visible there.

Setup

1. In WatchGuard Cloud, go to Administration > Managed Access and enable API access (Owner or Administrator role required). Use the read-only credential.
2. Configure the server in your MCP client:

{
  "mcpServers": {
    "watchguard": {
      "command": "npx",
      "args": ["-y", "superfast-watchguard-mcp"],
      "env": {
        "WATCHGUARD_ACCESS_ID": "<read-only access ID>",
        "WATCHGUARD_PASSWORD": "<read-only API password>",
        "WATCHGUARD_API_KEY": "<API key>",
        "WATCHGUARD_API_URL": "https://api.deu.cloud.watchguard.com",
        "WATCHGUARD_ACCOUNT_ID": "<your Service Provider account ID, e.g. ACC-1234567>"
      }
    }
  }
}

WATCHGUARD_API_URL is regional: api.usa.cloud.watchguard.com, api.deu.cloud.watchguard.com or api.jpn.cloud.watchguard.com — the correct one is shown on your Managed Access page. An optional WATCHGUARD_AUTH_URL overrides the token endpoint (defaults to {API_URL}/oauth/token).

Authentication

Uses the OAuth 2.0 client-credentials flow. Tokens last one hour and are cached with a 5-minute safety margin. Delegated access into a managed account uses the Authorization API (POST /rest/platform/authorization/v1/audiences) to obtain an audience value, then requests a token scoped to that account; audiences and per-account tokens are cached, with retry on transient failures.

Notes on the WatchGuard public API

• Per-device inventory comes from /rest/platform/allocation/v2/{accountId}/assets/summary/firebox?allocationStatus=allocated — the allocations endpoint only returns per-account counts and requires accountType=2.
• Security report views use a top_blocked_* naming scheme; executive views use top_*.
• The Accounts children endpoint paginates at 25 by default; this server requests limit=-1.
• There is no public API for live device status or firmware version, and report device filters need internal FB-xxxxx IDs the public API never returns — hence the console deep links and the account-level activity proxy.
• MSSP Command (service tier and monthly points) has no public API; wg_mssp_reconcile works from its CSV export instead.

Development

npm install
npm run build       # compile to dist/
npm run inspector   # interactive testing with the MCP Inspector (.env required)