mcp server
v0.15.0
MIT
rustpanosmcp
MCP server for Palo Alto Networks PAN-OS
Async Rust MCP server for Palo Alto Networks PAN-OS firewalls: bearer-token device and tool scopes and a guarded candidate-config lifecycle.
About
An async Rust Model Context Protocol server for Palo Alto Networks PAN-OS firewalls. It is a bearer-protected server with structured audit logging, a guarded PAN-OS candidate configuration lifecycle and hardened release packaging, with authentication and auditing from the shared mecmcp crates.
The goal is a small, fast, production-oriented server with the same security posture as rust-junosmcp.
Features
- Bearer-token authentication with per-token device and tool scopes
- TLS, strict remote-bind refusal rules, bounded input and output
- Guarded candidate config lifecycle: stage, diff, validate, partial commit and revert
- Wildcard token scopes reach only the read-only tools; write tools must be named explicitly
- Distroless container image and a hardened systemd unit
Quick start
Build from source
git clone https://github.com/mechubsec/rustpanosmcp
cd rustpanosmcp
cargo build --releaseRelease tarball (Linux x86_64)
curl -LO https://github.com/mechubsec/rustpanosmcp/releases/download/v0.15.0/rust-panosmcp-v0.15.0-x86_64-unknown-linux-gnu.tar.gz
curl -LO https://github.com/mechubsec/rustpanosmcp/releases/download/v0.15.0/rust-panosmcp-v0.15.0-x86_64-unknown-linux-gnu.tar.gz.sha256
sha256sum -c rust-panosmcp-v0.15.0-x86_64-unknown-linux-gnu.tar.gz.sha256