Check Point Quantum Management MCP Server

[PhoneBoy]

What is MCP?

Model Context Protocol (MCP) servers expose a structured, machine-readable API for your enterprise data—designed for AI-powered automation, copilots, and decision engines. By delivering a clear, contextual slice of your security environment, MCP lets you query, analyze, and optimize complex systems without building custom SDKs or parsing raw exports.

Why MCP for Security?

Security Policies often span hundreds of rules and thousands of objects across diverse enforcement points. Understanding, auditing, or optimizing these environments is slow and error-prone. MCP changes this: exposing security management data in a modular, context-rich format, ready for AI systems to consume. Enabling the AI to use your data with precision. Ask real-world questions, and get structured, actionable answers—instantly.

Features

• Query and visualize installed policies, rulebases, and network topology
• Retrieve and analyze access, NAT and VPN rules
• List and inspect objects such as hosts, networks, services, VPN communities, and more

Demo Video

Check Point MCP Server on Github

[the_rock]

Very interesting.

[APopisteru]

This is really cutting edge technology, since the entire architecture was released to open-source community exactly 6 months ago, and I saw a functional demo of an independent development of our genial regional SME M. K. in March.

Let's think a bit about what made this integration possible so quickly: a modular, micro-services like approach of API endpoints exposing more and more management and OS operations, in the larger context of the goal to provide the most streamlined and efficient platform operations. This can be extended to an agentic-AI approach that could lead to the first autonomous firewall (remember autonomous threat prevention and dynamic policy layers?).

I'm already thinking of a development to access cpview API (have a look at the revamped Skyline architecture), to query the realtime performance of the firewalls.

[genisis__]

Is this something that will replace Smart Optimise service?

[PhoneBoy]

Yes and no @genisis__ 

SmartOptimize is a service offered through Infinity Global Services.
A more direct replacement for this would the "Policy Advisor" functionality that was announced at CPX.

An MCP Server allows you to build your own "AI Copilot" of sorts using your data and chosen AI model hosted on your own infrastructure.
"Rulebase Optimization with AI" is one of the use cases explicitly mentioned.
However, this is a "build it yourself" tool (versus something we explicitly provide).

[D_W]

Is it planned to access Logs also via that service?

[PhoneBoy]

The Management APIs already supports querying for specific logs.
When using AI-Copilot with on-premise management, these APIs are used to perform some of the functions involving log data...if you've explicitly enabled this.
Whether the MCP Server we've released actually queries logs... @Eran_Habad can you comment?

If you're looking for bulk ingestion of logs, that still needs to be done with Log Exporter.

[Eran_Habad]

We're actually building a dedicated MCP for that. In this MCP, it's not possible to retrieve logs.

You can see the current API list for this MCP in code, at https://github.com/CheckPointSW/mcp-quantum/blob/main/packages/management/src/index.ts

[PhoneBoy]

Thanks, I was looking for that. 🙂

[Daniel_Hainich]

hi,

maybe iam wrong, but please check https://www.heise.de/en/news/Attack-via-GitHub-MCP-server-Access-to-private-data-10400040.html

[PhoneBoy]

From the article:  "The proof of concept does not directly exploit a vulnerability in the GitHub MCP server, but assumes a certain recklessness in dealing with the AI systems, which is probably not too far-fetched."

[Ruan_Kotze]

Very excited about this - but the instructions in the Git repo does not seem complete, or it assumes a level knowledge with MCP's that not a lot of us currently has.  Has anyone been able to build this?

Full disclosure - this is my first time trying to get something like this working so might also just be tripping over my own feet.

[Yoav_Geva]

Hi @Ruan_Kotze ,

In order to use the MCP servers, you just need to configure them in your MCP client of choice.
We have provided directions for doing it in four popular Apps that serve as MCP clients (Claude Desktop, Cursor, Windsurf and VS Code), but other apps are also viable.

For example, for Claude Desktop follow these instructions: 

https://github.com/CheckPointSW/mcp-servers?tab=readme-ov-file#configuring-the-claude-desktop-app

As always, the since you use personal and potentially sensitive data,  be sure you trust the client application.

In the Git repo we also provided instructions how to build it, but these are provided only for developers who wish to add more context or use this code in their own apps. If you only wish to use the servers you do not need this phase.

[Ruan_Kotze]

Thanks for responding Yoav,

We've done the integration for Claude and satisfied the pre-requisites - here's what I did:
- Installed Claude desktop
- Installed Node.JS
- Configured claude_desktop_config.json with our environment settings

Despite this I'm not seeing the MCP pop up under the styles menu in Claude desktop. Am I missing any steps? 

I Have also reviewed Claude Desktops log files (main.log / window.log) for any possible errors, but couldn't find anything relevant. 

Starting up the MCP manually via "npx @CHKP/quantum-management-mcp" outputs "Management MCP server running on stdio. Version: 0.0.10" so connectivity seems in order as well.

Thanks,
Ruan

[Ruan_Kotze · Accepted solution]

Managed to resolve my issue.  Slightly embarrassing to admit but it was because I never enabled "Developer" mode in Claude desktop.

In my defense it was not in "Developer Settings" but buried in the Help hamburger menu:-)