Firewalla MCP Server

Firewalla MCP Server MCP Server

Real-time network monitoring, security analysis, and firewall management through 28 specialized tools. Access security alerts, network flows, device status, and firewall rules directly from your Firewalla device.

What is an MCP Server?⁠

Characteristics

Attribute	Details
Docker Image	mcp/firewalla-mcp-server⁠
Author	amittell⁠
Repository	https://github.com/amittell/firewalla-mcp-server⁠
Dockerfile	https://github.com/amittell/firewalla-mcp-server/blob/main/Dockerfile⁠
Docker Image built by	Docker Inc.
Docker Scout Health Score
Verify Signature	COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/firewalla-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub
Licence	MIT License

Available Tools (28)

Tools Details

Tool: create_target_list

Create a new target list

Tool: delete_target_list

Delete a target list

Tool: get_active_alarms

Retrieve current security alerts and alarms from Firewalla firewall

Tool: get_alarm_trends

Get historical alarm trend data (alarms generated per day)

Tool: get_bandwidth_usage

Get top bandwidth consuming devices (convenience wrapper around get_device_status)

Tool: get_boxes

Retrieve list of Firewalla boxes

Tool: get_device_status

Check online/offline status of devices on Firewalla network

Tool: get_flow_data

Query network traffic flows from Firewalla firewall

Tool: get_flow_insights

Get category-based flow analysis including top content categories, bandwidth consumers, and blocked traffic. Ideal for answering questions like "what porn sites were accessed" or "what social media was used". Replaces time-based trends with actionable insights.

Tool: get_network_rules

Retrieve firewall rules and conditions

Tool: get_network_rules_summary

Get overview statistics and counts of network rules by category (convenience wrapper)

Tool: get_offline_devices

Get all offline devices (convenience wrapper around get_device_status)

Tool: get_recent_flow_activity

Get recent network flow activity snapshot (last 10-20 minutes). Returns up to 50 most recent flows for immediate analysis. CRITICAL: This is a quick snapshot tool only. Use this for: "what's happening right now?", current security threats, immediate network issues. DO NOT use for: historical analysis (use search_flows), getting more than 50 flows (use search_flows with limit), daily/weekly patterns (use search_flows with time queries like "ts:>24h"). For comprehensive analysis, always prefer search_flows.

Tool: get_rule_trends

Get historical rule trend data (rules created per day)

Tool: get_simple_statistics

Retrieve basic statistics overview

Tool: get_specific_alarm

Get detailed information for a specific Firewalla alarm

Tool: get_specific_target_list

Retrieve a specific target list by ID

Tool: get_statistics_by_box

Get statistics for each Firewalla box (top boxes by blocked flows or security alarms)

Tool: get_statistics_by_region

Retrieve statistics by region (top regions by blocked flows)

Tool: get_target_lists

Retrieve all target lists from Firewalla

Tool: pause_rule

Temporarily disable an active firewall rule for a specified duration

Tool: resume_rule

Resume a previously paused firewall rule, restoring it to active state

Tool: search_alarms

Search alarms using full-text or field filters. Alarm types: 1=Security Activity, 2=Abnormal Upload, 3=Large Bandwidth Usage, 4=Monthly Data Plan, 5=New Device, 6=Device Back Online, 7=Device Offline, 8=Video Activity, 9=Gaming Activity, 10=Porn Activity, 11=VPN Activity, 12=VPN Connection Restored, 13=VPN Connection Error, 14=Open Port, 15=Internet Connectivity Update, 16=Large Upload.

Tool: search_devices

Search devices by name, IP, MAC or status (convenience wrapper with client-side filtering)

Tool: search_flows

Search network flows with advanced query filters. Use this for: historical analysis, specific time ranges, complex filtering, or when you need more than 50 flows. Supports pagination, time-based queries (e.g., "ts:>1h" for last hour), and all flow fields including geographic filtering. For quick "what's happening now" snapshots, use get_recent_flow_activity instead.

Tool: search_rules

Search firewall rules by target, action or status. Supports all rule fields.

Tool: search_target_lists

Search target lists with client-side filtering (convenience wrapper around get_target_lists)

Tool: update_target_list

Update an existing target list

Use this MCP Server

{
  "mcpServers": {
    "firewalla-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "FIREWALLA_MSP_ID",
        "-e",
        "FIREWALLA_BOX_ID",
        "-e",
        "MCP_WAVE0_ENABLED",
        "-e",
        "MCP_READ_ONLY_MODE",
        "-e",
        "MCP_CACHE_ENABLED",
        "-e",
        "MCP_DEBUG_MODE",
        "-e",
        "NODE_ENV",
        "-e",
        "LOG_LEVEL",
        "-e",
        "MCP_CACHE_TTL",
        "-e",
        "MCP_RATE_LIMIT_WINDOW",
        "-e",
        "MCP_RATE_LIMIT_MAX_REQUESTS",
        "-e",
        "FIREWALLA_MSP_TOKEN",
        "mcp/firewalla-mcp-server"
      ],
      "env": {
        "FIREWALLA_MSP_ID": "yourdomain.firewalla.net",
        "FIREWALLA_BOX_ID": "1eb71e38-3a95-4371-8903-ace24c83ab49",
        "MCP_WAVE0_ENABLED": "<nil>",
        "MCP_READ_ONLY_MODE": "<nil>",
        "MCP_CACHE_ENABLED": "<nil>",
        "MCP_DEBUG_MODE": "<nil>",
        "NODE_ENV": "<nil>",
        "LOG_LEVEL": "<nil>",
        "MCP_CACHE_TTL": "<nil>",
        "MCP_RATE_LIMIT_WINDOW": "<nil>",
        "MCP_RATE_LIMIT_MAX_REQUESTS": "<nil>",
        "FIREWALLA_MSP_TOKEN": "your_msp_access_token_here"
      }
    }
  }
}

Why is it safer to run MCP Servers with Docker?⁠