Palo Alto Networks Enterprise DLP MCP server
Lets your AI assistant review Enterprise DLP incidents, data profiles and patterns from Palo Alto Networks, read-only by default.
This is Palo Alto Networks' server for Enterprise DLP. It lets Claude, Cursor or VS Code look at incidents, data profiles, data patterns and reports, and it comes with prompts for triage, coverage audits and policy tuning. It runs on your machine and signs in with a Strata Cloud Manager service account. Read-only is the default, so the assistant gets no write or delete tools until you turn them on.
Good for
- Security analysts who triage and investigate DLP incidents
- DLP admins who tune data profiles and patterns
- Compliance teams checking coverage for GDPR, PCI-DSS, HIPAA and CCPA
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install Palo Alto Networks Enterprise DLP MCP
Claude Code
- 1
Copy this prompt.
Add the Palo Alto Networks Enterprise DLP MCP server to Claude Code. Run this command: claude mcp add dlp -e DLP_CLIENT_ID=<DLP_CLIENT_ID> -e DLP_CLIENT_SECRET=<DLP_CLIENT_SECRET> -e DLP_TSG_ID=<DLP_TSG_ID> -- npx -y @paloaltonetworks/mcp-dlp Ask me for DLP_CLIENT_ID, DLP_CLIENT_SECRET, DLP_TSG_ID and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Node.js.
Built from the package data we hold. Not yet tested by us.
Tools
We don't list Palo Alto Networks Enterprise DLP MCP's tools here yet. After you connect it, ask your assistant "What can you do with Palo Alto Networks Enterprise DLP MCP?" to see them.
Permissions
high risk · 5 things to watch
High risk
Once you turn writes on, the assistant can create, change and delete data profiles and patterns, and change incident status. Keep the default read-only mode and use a service account that can only read.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
Turning on writes also turns on deletes
One setting enables every write and destructive tool. Do it only for a task that needs it, then switch back. npmjs.com
The service account sets the real limit
Read-only mode is a setting in this server. A service account with write permissions can still change things through other tools, so give the assistant a read-only account. npmjs.com
Incident reports can include data snippets
Evidence and report data may contain pieces of the sensitive content that triggered the incident. That text goes to your AI provider, so check your policy first. npmjs.com
HTTP mode has no sign-in of its own
In the optional HTTP mode one shared service account serves every request and the server binds to all addresses by default. Run it only on a trusted network or behind a proxy. npmjs.com
Usage reports are on by default
Set the telemetry setting to off to stop remote reports. npmjs.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Turning on read-only | Read-only is the default: write and destructive tools are not registered. Set DLP_READ_ONLY to 0, false or no to allow them. Use a read-only service account to enforce it on the server side too. |
|---|---|
| Talks to | Palo Alto Networks DLP, authentication and SASE APIs (paloaltonetworks.com hosts). Remote usage reports (can be turned off) |
| Scopes |
|
Questions
Is it read-only?
Yes, by default. Write and destructive tools are not even listed until you set DLP_READ_ONLY to 0, false or no.
What do I need to sign in?
A Strata Cloud Manager service account with the Superuser or DLP Incident Administrator role and Enterprise DLP enabled. You also need its client ID, client secret and your TSG ID.
Does it run locally or in the cloud?
Locally. Your AI client starts it on your machine, and it calls the Palo Alto Networks DLP APIs. There is also a standalone binary for machines without Node.js, and an optional HTTP mode for hosting it as a service.
Which tools does it have?
The README describes the areas it covers, such as incidents, data profiles and patterns, reports and configuration export and import, but does not list each tool by name. The assistant can show you the live list once connected.
What are the built-in prompts?
They are ready-made workflows such as triage-incidents, investigate-incident, audit-coverage and policy-tuning. Several are marked read-only, and others ask for your approval before changing anything.
How do I add it to Claude or Cursor?
Use the install box above and fill in the three required values. Palo Alto's README also shows VS Code and a standalone binary.
Information
updated Nov 2, 2026
- Publisher
- Palo Alto Networks (official)
- Package
@paloaltonetworks/mcp-dlp- Registry
- npm
- Transport
- stdio, Streamable HTTP
- Auth
- token in env
- Version
- 0.13.0
- License
- MIT
Other Palo Alto Networks MCP servers
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 1Hide
- @paloaltonetworks/mcp-dlp on npm · npmjs.com