Sonicwall

This SonicWall MCP Server provides natural language powered analysis of SonicWall firewall logs and threat detection through the MCP protocol. It supports both SonicOS 7.x and 8.x with version-aware endpoints, and exposes tools for log analysis, threat monitoring, connection investigations, statistics, and log export. You can connect Claude or other MCP clients to its SSE endpoint to perform conversational queries like asking for blocked connections, suspicious activity, or export-ready logs. The included tools help you perform targeted queries (analyze_logs), monitor real-time threats (get_threats), search specific connections (search_connections), retrieve network metrics (get_stats), and export filtered logs (export_logs).

Prerequisites:

• Docker Engine and Docker Compose
• Access to a SonicWall device with API enabled (MANAGE > System Setup > Appliance > SonicOS API)
• Optional: Node.js 20+ if you prefer local Node-based deployment

Step-by-step:

1. Clone the repository and navigate to project folder

git clone https://github.com/gensecaihq/sonicwall-mcp-server.git
cd sonicwall-mcp-server

2. Prepare environment file (example shown). Copy the example and fill in your values

cp .env.example .env

3. Configure environment variables in .env (examples):

SONICWALL_HOST=192.168.1.1
SONICWALL_USERNAME=admin
SONICWALL_PASSWORD=your_password
SONICWALL_VERSION=7  # use 8 for SonicOS 8.x
PORT=3000
LOG_LEVEL=info
CACHE_TTL_SECONDS=300

4. Start the server via Docker (recommended):

# Ensure Docker and Docker Compose are up
# Start in detached mode
docker compose up -d

5. Optional: start with npm/node setup

npm install
npm run build
npm start

6. Verify the server health endpoint (default port 3000)

curl http://localhost:3000/health

Expected: {"status":"healthy","protocol":"MCP/2025-06-18","version":"1.0.0"}

Notes and tips:

• Ensure SonicWall API is enabled and reachable from the deployment host.
• Use the SonicWall_VERSION setting that matches your device (7 or 8).
• If using Docker, you can map a host port to 3000 by adjusting the docker-compose setup or the PORT env value.
• The MCP configuration assumes MCP 2025-06-18 compliance and SSE transport; monitor logs for authentication token handling and endpoint resolution messages.
• For Claude integration, configure the Claude Desktop to point to http://<host>:<port>/mcp/v1/sse and ensure CORS if needed.
• Common issues: network connectivity to the SonicWall, wrong API credentials, or mismatched SonicOS version leading to endpoint failures. Enable verbose logs (LOG_LEVEL) to troubleshoot.