Skip to content

Commit 6274376

Browse files
chkp-yoavgchkp-yoavg
authored
Merge pull request #15 from CheckPointSW/readme
Readme
2 parents 96843c8 + 7d75d63 commit 6274376

File tree

3 files changed

+251
-1
lines changed

3 files changed

+251
-1
lines changed

‎packages/infra/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Check Point Quantum Infra
2+
3+
This package is a depedency of Check Point Quantum MCP servers

‎packages/management/README.md

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
# Check Point Quantum Management MCP Server
2+
3+
## What is MCP?
4+
5+
The Model Context Protocol (MCP) is a standardized interface that allows AI agents and automation tools to interact programmatically with Check Point Quantum Management servers. Using MCP, you can:
6+
7+
- Query and visualize installed policies, rulebases, and network topology
8+
- Retrieve and analyze access, NAT, and threat prevention rules
9+
- List and inspect objects such as hosts, networks, services, VPN communities, and more
10+
11+
## Demo
12+
13+
[![Watch the demo](https://img.youtube.com/vi/QKBcD_99W3s/0.jpg)](https://www.youtube.com/watch?v=QKBcD_99W3s)
14+
15+
## Example Use Cases
16+
17+
### Ensure regulatory compliance with industry standards
18+
Prompt: Check if my gateway configuration meets PCI-DSS/HIPAA/GDPR requirements.
19+
20+
### Find broad-definition rules
21+
Prompt: List all firewall rules that allow traffic from any source to any destination on any port. Highlight rules that are disabled or unused.
22+
23+
### Source → Destination Path Analysis
24+
Prompt: Can you check in my policy if a host or network can access the internet?
25+
26+
### Recommendation for rulebase optimization
27+
Prompt: Take a look at the internet-facing rules in my policy and suggest improvements. Identify any rules that should be strengthened or loosened. Consider both security risks and administrative overhead. In your recommendations, refer only to specific rules that can be changed or suggest adding new ones.
28+
29+
### Custom policy visualizations
30+
Prompt: Please create a visual report that shows which services are allowed in my network, under which conditions, and which services are strictly blocked.
31+
32+
---
33+
34+
## Configuration Options
35+
36+
This server supports two main modes of authentication:
37+
38+
### 1. Smart-1 Cloud (API Key)
39+
40+
Authenticate to Check Point Smart-1 Cloud using an API key.
41+
42+
- **How to generate an API key:**
43+
In your Smart-1 Cloud dashboard, go to **Settings → API & SmartConsole** and generate an API key.
44+
Copy the key and the server login URL (excluding the `/login` suffix) to your client settings.
45+
![alt text](./resources/s1c_api_key.png)
46+
47+
Set the following environment variables:
48+
49+
- `API_KEY`: Your Smart-1 Cloud API key
50+
- `S1C_URL`: Your Smart-1 Cloud tenant "Web-API" URL
51+
52+
---
53+
54+
### 2. On-Prem Management (API Key or Username/Password)
55+
56+
- **Configure your management server to allow API access:**
57+
To use this server with an on-premises Check Point management server, you must first enable API access.
58+
Follow the official instructions for [Managing Security through API](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SmartProvisioning_AdminGuide/Content/Topics-SPROVG/Managing-Security-through-API.htm).
59+
60+
- **Authenticate to the Security Management Server** using either an API key or username/password:
61+
- Follow the official instructions: [Managing Administrator Accounts (Check Point R81+)](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Managing_Administrator_Accounts.htm)
62+
- When creating the administrator, assign appropriate permissions for API access and management operations.
63+
- You can authenticate using an API key (recommended for automation) or username/password credentials.
64+
65+
Set the following environment variables:
66+
67+
- `MANAGEMENT_HOST`: IP address or hostname of your management server
68+
- `PORT`: (Optional) Management server port (default: 443)
69+
- `API_KEY`: Your management API key (if using API key authentication)
70+
- `USERNAME`: Username for authentication (if using username/password authentication)
71+
- `PASSWORD`: Password for authentication (if using username/password authentication)
72+
73+
---
74+
75+
## Client Configuration
76+
77+
### Prerequisites
78+
79+
Download and install the latest version of [Node.js](https://nodejs.org/en/download/) if you don't already have it installed.
80+
You can check your installed version by running:
81+
82+
```bash
83+
node -v # Should print "v22" or higher
84+
nvm current # Should print "v22" or higher
85+
```
86+
87+
### Supported Clients
88+
89+
This server has been tested with Claude Desktop, Cursor, GitHub Copilot, and Windsurf clients.
90+
It is expected to work with any MCP client that supports the Model Context Protocol.
91+
92+
> **Note:** Due to the nature of management API calls and the variety of server tools, using this server may require a paid subscription to the model provider to support token limits and context window sizes.
93+
> For smaller models, you can reduce token usage by limiting the number of enabled tools in the client.
94+
95+
### Smart-1 Cloud Example
96+
97+
```json
98+
{
99+
"mcpServers": {
100+
"quantum-management": {
101+
"command": "npx",
102+
"args": ["@chkp/quantum_management_mcp"],
103+
"env": {
104+
"API_KEY": "YOUR_API_KEY",
105+
"S1C_URL": "YOUR_S1C_URL" // e.g., https://xxxxxxxx.maas.checkpoint.com/yyyyyyy/web_api
106+
}
107+
}
108+
}
109+
}
110+
```
111+
112+
### On-Prem Management Example
113+
114+
```json
115+
{
116+
"mcpServers": {
117+
"quantum-management": {
118+
"command": "npx",
119+
"args": ["@chkp/quantum_management_mcp"],
120+
"env": {
121+
"MANAGEMENT_HOST": "YOUR_MANAGEMENT_IP_OR_HOST_NAME",
122+
"MANAGEMENT_PORT": "443", // optional, default is 443
123+
"API_KEY": "YOUR_API_KEY", // or use USERNAME and PASSWORD
124+
"USERNAME": "YOUR_USERNAME", // optional
125+
"PASSWORD": "YOUR_PASSWORD" // optional
126+
}
127+
}
128+
}
129+
}
130+
```
131+
132+
> Set only the environment variables required for your authentication method.
133+
134+
### Configuring the Claude Desktop App
135+
136+
#### For macOS:
137+
138+
```bash
139+
# Create the config file if it doesn't exist
140+
touch "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
141+
142+
# Open the config file in TextEdit
143+
open -e "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
144+
```
145+
146+
#### For Windows:
147+
148+
```cmd
149+
code %APPDATA%\Claude\claude_desktop_config.json
150+
```
151+
152+
Add the server configuration:
153+
154+
```json
155+
{
156+
"mcpServers": {
157+
"quantum-management": {
158+
"command": "npx",
159+
"args": ["@chkp/quantum_management_mcp"],
160+
"env": {
161+
// Add the configuration from the above instructions
162+
}
163+
}
164+
}
165+
}
166+
```
167+
168+
### VSCode
169+
170+
Enter VSCode settings and type "mcp" in the search bar.
171+
You should see the option to edit the configuration file.
172+
Add this configuration:
173+
174+
```json
175+
{
176+
...
177+
"mcp": {
178+
"inputs": [],
179+
"servers": {
180+
"quantum-management": {
181+
"command": "npx",
182+
"args": [
183+
"@chkp/quantum_management_mcp"
184+
],
185+
"env": {
186+
"MANAGEMENT_HOST": "YOUR_MANAGEMENT_IP_OR_HOST_NAME",
187+
"MANAGEMENT_PORT": "443", // optional, default is 443
188+
"API_KEY": "YOUR_API_KEY", // or use USERNAME and PASSWORD
189+
"USERNAME": "YOUR_USERNAME", // optional
190+
"PASSWORD": "YOUR_PASSWORD" // optional
191+
}
192+
}
193+
}
194+
},
195+
...
196+
}
197+
```
198+
199+
### Windsurf
200+
201+
Enter Windsurf settings and type "mcp" in the search bar.
202+
You should see the option to edit the configuration file.
203+
Add the configuration as Claude Desktop App.
204+
205+
### Cursor
206+
207+
Enter Cursor settings and click on "MCP Servers" in the left menu.
208+
You should see the option to add a new MCP Server.
209+
Add the configuration as Claude Desktop App.
210+
---
211+
212+
## Development
213+
214+
### Prerequisites
215+
216+
- Node.js 22+
217+
- npm 10+
218+
219+
### Setup
220+
221+
```bash
222+
# Install all dependencies
223+
npm install
224+
```
225+
226+
### Build
227+
228+
```bash
229+
# Build all packages
230+
npm run build
231+
```
232+
233+
### Running Locally
234+
235+
You can run the server locally for development using [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) or any compatible MCP client.
236+
237+
```bash
238+
node FULL_PATH_TO_SERVER/packages/management/dist/index.js --s1c-url|--management-host --api-key|--username|--password
239+
```
240+
241+
---
242+
243+
## ⚠️ Security Notice
244+
245+
1. **Authentication keys and credentials are never shared with the model.** They are used only by the MCP server to authenticate with your Check Point management system.
246+
2. **Only use client implementations you trust.** Malicious or untrusted clients could misuse your credentials or access data improperly.
247+
3. **Management data is exposed to the model.** Ensure that you only use models and providers that comply with your organization’s policies for handling sensitive data and PII.

‎packages/management/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "@chkp/quantum-management-mcp",
33
"version": "1.0.16",
44
"bin": {
5-
"genai-mcp-server-management": "dist/index.js"
5+
"quantum-management-mcp": "dist/index.js"
66
},
77
"description": "Official MCP server for Check Point Quantum Management",
88
"type": "module",

0 commit comments

Comments
 (0)