checkpoint-mcp-server

An MCP (Model Context Protocol) server for the Check Point Management API, enabling AI assistants such as Claude to manage Check Point firewall policy, network objects, NAT rules, and security gateways through natural language.

---

Features

• Traditional mode — individual, named MCP tools for every common operation (show hosts, add rules, publish, etc.)
• Code mode — a single checkpoint_execute tool that runs arbitrary JavaScript against the API for advanced automation
• Read-only by default; write operations require explicit opt-in
• Automatic session management with auto-login
• Supports Check Point R80.x and R81.x Management APIs
• Full TypeScript with strict types throughout

---

Prerequisites

• Node.js 18 or later
• A Check Point SmartCenter or Multi-Domain Management server with the Management API enabled
• API access enabled on the management station (mgmt_cli or SmartConsole API access settings)
• Network connectivity from the machine running this server to the management API port (default: HTTPS/443)

---

Installation

git clone https://github.com/cheenu1092-oss/checkpoint-mcp-server.git
cd checkpoint-mcp-server
npm install
npm run build

The build produces two entry points:

File	Description
dist/traditional/index.js	Traditional mode with individual named tools
dist/code-mode/index.js	Code mode with a single checkpoint_execute tool

---

Configuration

All configuration is supplied via environment variables.

Variable	Required	Default	Description
CHECKPOINT_HOST	Yes	—	Base URL of the management API, e.g. https://192.168.1.100
CHECKPOINT_USERNAME	Yes	—	API administrator username
CHECKPOINT_PASSWORD	Yes	—	API administrator password
CHECKPOINT_DOMAIN	No	—	Domain name (Multi-Domain deployments only)
CHECKPOINT_VERIFY_SSL	No	true	Set to false to skip TLS certificate verification (not recommended for production)
CHECKPOINT_SESSION_TIMEOUT	No	600	Session idle timeout in seconds
CHECKPOINT_ENABLE_WRITE	No	false	Set to true to enable object creation, modification, deletion, and rule management

---

Usage with Claude Desktop

Add one (or both) of the following entries to your Claude Desktop configuration file.

Traditional mode (recommended for most users)

{
  "mcpServers": {
    "checkpoint": {
      "command": "node",
      "args": ["/absolute/path/to/checkpoint-mcp-server/dist/traditional/index.js"],
      "env": {
        "CHECKPOINT_HOST": "https://your-management-server",
        "CHECKPOINT_USERNAME": "admin",
        "CHECKPOINT_PASSWORD": "your-password",
        "CHECKPOINT_DOMAIN": "Global",
        "CHECKPOINT_ENABLE_WRITE": "false"
      }
    }
  }
}

Code mode (advanced)

{
  "mcpServers": {
    "checkpoint-code": {
      "command": "node",
      "args": ["/absolute/path/to/checkpoint-mcp-server/dist/code-mode/index.js"],
      "env": {
        "CHECKPOINT_HOST": "https://your-management-server",
        "CHECKPOINT_USERNAME": "admin",
        "CHECKPOINT_PASSWORD": "your-password",
        "CHECKPOINT_ENABLE_WRITE": "true"
      }
    }
  }
}

---

Available Tools (Traditional Mode)

Session / System

Tool	Description
checkpoint_show_session	Show current session information
checkpoint_show_tasks	Show async task status
checkpoint_show_gateways_and_servers	List all managed gateways and servers
checkpoint_publish	Commit pending changes to the database
checkpoint_discard	Roll back pending changes

Network Objects

Tool	Description
checkpoint_show_hosts	List host objects (paginated)
checkpoint_show_host	Show a single host by name or UID
checkpoint_add_host	Create a host object
checkpoint_set_host	Update a host object
checkpoint_delete_host	Delete a host object
checkpoint_show_networks	List network objects (paginated)
checkpoint_show_network	Show a single network
checkpoint_add_network	Create a network object
checkpoint_set_network	Update a network object
checkpoint_delete_network	Delete a network object
checkpoint_show_groups	List group objects (paginated)
checkpoint_show_group	Show a single group with its members
checkpoint_add_group	Create a group
checkpoint_set_group	Update a group
checkpoint_delete_group	Delete a group
checkpoint_show_services_tcp	List TCP service objects
checkpoint_show_service_tcp	Show a single TCP service
checkpoint_show_services_udp	List UDP service objects
checkpoint_show_service_udp	Show a single UDP service

Access Policy

Tool	Description
checkpoint_show_access_layers	List access policy layers
checkpoint_show_access_layer	Show a single access layer
checkpoint_show_access_rulebase	Show rules in a layer (paginated)
checkpoint_show_access_rule	Show a single rule
checkpoint_add_access_rule	Add a rule to a layer
checkpoint_set_access_rule	Modify an existing rule
checkpoint_delete_access_rule	Delete a rule

NAT

Tool	Description
checkpoint_show_nat_rulebase	Show NAT rulebase for a package
checkpoint_show_nat_rule	Show a single NAT rule
checkpoint_add_nat_rule	Add a NAT rule
checkpoint_set_nat_rule	Modify a NAT rule
checkpoint_delete_nat_rule	Delete a NAT rule

Code Mode

Tool	Description
checkpoint_execute	Execute JavaScript code against the Check Point API

---

Security Notes

• Write operations are disabled by default. You must set CHECKPOINT_ENABLE_WRITE=true to permit any create, update, or delete operation.
• Changes are not live until published. All write operations create pending changes in the current session. Call checkpoint_publish (traditional) or await client.publish() (code mode) to commit them. Call checkpoint_discard to roll back.
• Code mode executes arbitrary JavaScript in the Node.js process. It is intended for trusted operators and developers only, not for use with untrusted input sources.
• Store credentials in environment variables or a secrets manager, never hardcoded in configuration files.
• Use a dedicated API administrator account with the minimum required permissions.

---

Development

# Run tests
npm test

# Build all targets
npm run build

# Build individual targets
npm run build:traditional
npm run build:code-mode

---

License

MIT