Palo Alto Networks MCP servers: which one for firewalls, Cortex or DLP
No official firewall server exists. Palo Alto's own servers cover Cortex and Enterprise DLP; PAN-OS firewalls and Panorama need a community server.
- Servers
- 2
- active
- Official
- 2
- by Palo Alto Networks
- Local
- 2
- runs on your machine
Palo Alto Networks makes no MCP server for its firewalls, so if you run PAN-OS or Panorama, you need a community server. Its official servers cover other products: one for Cortex XSIAM, XDR and Cortex Cloud cases, and one for Enterprise DLP. The DLP server only reads until you turn read-only mode off; for Cortex, the docs say the built-in tools only read, but the launch post describes updating cases and adding notes. Firewall servers can change live security policy, so start any of them with the least access you can.
Good for
- Firewall and Panorama admins who want to ask about rules, objects and logs in plain language
- SOC analysts working cases and issues in Cortex XSIAM, XDR or Cortex Cloud
- Data security teams triaging Enterprise DLP incidents and data profiles
- Teams that want an assistant to look, not change, security settings
Which Palo Alto Networks MCP server to use
Use the Cortex server for XSIAM, XDR or Cortex Cloud, and the Enterprise DLP server for DLP; both are official, and DLP only reads until you opt in. For PAN-OS firewalls and Panorama, apius-tech's PanOS MCP is the most-starred but can change config, while node804-panos-mcp and cdot65's pan-os-mcp only read unless you opt in.
| Server | Official | For | Runs | Sign-in | Can change things | Tools |
|---|---|---|---|---|---|---|
| For Palo Alto Networks | ||||||
| Cortex MCP ServerThis page | Official | Cortex | Local | API key | Unclear | – |
| Enterprise DLP | Official | Enterprise DLP | Local | Service account | Opt-in | 99 |
| Other tools for the same job | ||||||
| PanOS MCP (apius-tech) | Community | Firewalls, Panorama | Local | API key | Yes | – |
| node804-panos-mcp | Community | Firewalls, Panorama | Local | API key | Opt-in | 137 |
| pan-os-mcp (cdot65) | Community | Firewalls | Local | API key | No | – |
All Palo Alto Networks MCP servers
2 active · 2 official · official first, then by GitHub stars
- Palo Alto Networks Enterprise DLP MCP ServerOfficialLocaltoken in env
Palo Alto Networks' MCP server for Enterprise DLP: incidents, data profiles, data patterns and reports from Claude, Cursor or VS Code. Read-only unless you opt in to writes. Signs in with a Strata Cloud Manager service account.
580/wk downloads a week - Cortex MCP ServerOfficialLocalAPI key
Palo Alto Networks' MCP server for Cortex XSIAM, XDR and Cortex Cloud: look up cases, issues, assets and endpoints in plain language. Downloaded from your tenant, run with Docker or Python.
Questions
Is there an official Palo Alto firewall (PAN-OS) MCP server?
No. Palo Alto's official MCP servers cover Cortex and Enterprise DLP. Servers for PAN-OS firewalls and Panorama are community projects that use the firewall's XML API and an API key.
Which Palo Alto MCP server should I use?
Pick by product. Use the Cortex MCP Server for Cortex XSIAM, XDR or Cortex Cloud, the Enterprise DLP server for DLP incidents and profiles, and a community PAN-OS server for firewalls and Panorama.
Is it safe to connect my firewall to an AI assistant?
Only with care. Firewall servers can change and commit security policy, and an AI can misread an instruction. Use an API key from a read-only admin account, and review every change before it is committed.
Can the Cortex MCP server change cases or isolate endpoints?
Palo Alto's own sources disagree. The setup docs say the built-in tools only read from your tenant and that you can add your own tools that write, while the launch post describes changing case severity and status and adding notes. Test with a Viewer-role key before you rely on either.
Where do I download the Cortex MCP server?
From your Cortex tenant, under Settings, Configurations, Integrations, Cortex MCP Server. It is not on npm or GitHub, and it runs with Docker or Python 3.13 or newer.
Is the Enterprise DLP MCP server read-only?
Yes, by default. Tools that change or delete DLP settings stay hidden until you turn read-only mode off. The service account it signs in with needs the Superuser or DLP Incident Administrator role.
Can I use these in Claude on the web or ChatGPT?
Not directly. None of them is hosted; they run on your computer or in a container, so they suit Claude Desktop, Claude Code, Cursor and VS Code.
Does Palo Alto offer a way to secure my other MCP servers?
Yes. Its Prisma AIRS MCP Relay sits between your AI app and other MCP servers and scans tool descriptions, calls and responses for threats. It needs Prisma AIRS AI Runtime API intercept onboarded in Strata Cloud Manager and an API key from it.