Skip to content

Commit 78afdd6

Browse files
chkp-nirmchkp-nirm
authored
Merge pull request #26 from CheckPointSW/chkp-nirm-patch-1
Update README.md
2 parents c247141 + 1210d74 commit 78afdd6

File tree

1 file changed

+232
-45
lines changed

1 file changed

+232
-45
lines changed

‎README.md

Lines changed: 232 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,73 +1,260 @@
1-
# MCP Servers Monorepo
1+
# Check Point Quantum Management MCP Server
22

3-
This repository contains a collection of Model Context Protocol (MCP) servers implemented in TypeScript. Each server is organized as a separate package within the monorepo structure.
3+
## What is MCP?
44

5-
## Getting Started
5+
Model Context Protocol (MCP) servers expose a structured, machine-readable API for your enterprise data—designed for AI-powered automation, copilots, and decision engines. By delivering a clear, contextual slice of your security environment, MCP lets you query, analyze, and optimize complex systems without building custom SDKs or parsing raw exports.
66

7-
To work with this repository:
7+
## Why MCP for Security?
8+
9+
Security Policies often span hundreds of rules and thousands of objects across diverse enforcement points. Understanding, auditing, or optimizing these environments is slow and error-prone.
10+
MCP changes this: exposing security management data in a modular, context-rich format, ready for AI systems to consume. Enabling the AI to use your data with precision. Ask real-world questions, and get structured, actionable answers—instantly.
11+
12+
## Features
13+
14+
- Query and visualize installed policies, rulebases, and network topology
15+
- Retrieve and analyze access, NAT and VPN rules
16+
- List and inspect objects such as hosts, networks, services, VPN communities, and more
17+
18+
## Demo
19+
20+
[![Watch the demo](https://img.youtube.com/vi/QKBcD_99W3s/0.jpg)](https://www.youtube.com/watch?v=QKBcD_99W3s)
21+
22+
## Example Use Cases
23+
24+
### Regulatory Compliance Checks
25+
“Do my current gateways meet PCI-DSS, HIPAA, or GDPR standards?”
26+
*→ Returns a detailed gap analysis across your policy layers.*
27+
28+
### Risky Rule Discovery
29+
“Show all rules that allow any-to-any traffic. Highlight unused or disabled rules.”
30+
*→ Surfaces misconfigurations and expands your visibility.*
31+
32+
### Path Analysis for Access
33+
“Can host 10.1.2.7 access the internet under current policy?”
34+
*→ Traces real access flows across Access, NAT, and interfaces.*
35+
36+
### Rulebase Optimization with AI
37+
“Review internet-facing rules and suggest which should be tightened or removed.”
38+
*→ Actionable insights that improve your security posture.*
39+
40+
### Visual Policy Mapping
41+
“Generate a report showing allowed and blocked services across my environment.”
42+
*→ Delivers structured data for dashboards, reports, and audits.*
43+
44+
---
45+
46+
## Configuration Options
47+
48+
This server supports two main modes of authentication:
49+
50+
### 1. Smart-1 Cloud (API Key)
51+
52+
Authenticate to Check Point Smart-1 Cloud using an API key.
53+
54+
- **How to generate an API key:**
55+
In your Smart-1 Cloud dashboard, go to **Settings → API & SmartConsole** and generate an API key.
56+
Copy the key and the server login URL (excluding the `/login` suffix) to your client settings.
57+
![alt text](./resources/s1c_api_key.png)
58+
59+
Set the following environment variables:
60+
61+
- `API_KEY`: Your Smart-1 Cloud API key
62+
- `S1C_URL`: Your Smart-1 Cloud tenant "Web-API" URL
63+
64+
---
65+
66+
### 2. On-Prem Management (API Key or Username/Password)
67+
68+
- **Configure your management server to allow API access:**
69+
To use this server with an on-premises Check Point management server, you must first enable API access.
70+
Follow the official instructions for [Managing Security through API](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SmartProvisioning_AdminGuide/Content/Topics-SPROVG/Managing-Security-through-API.htm).
71+
72+
- **Authenticate to the Security Management Server** using either an API key or username/password:
73+
- Follow the official instructions: [Managing Administrator Accounts (Check Point R81+)](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Managing_Administrator_Accounts.htm)
74+
- When creating the administrator, assign appropriate permissions for API access and management operations.
75+
- You can authenticate using an API key (recommended for automation) or username/password credentials.
76+
77+
Set the following environment variables:
78+
79+
- `MANAGEMENT_HOST`: IP address or hostname of your management server
80+
- `PORT`: (Optional) Management server port (default: 443)
81+
- `API_KEY`: Your management API key (if using API key authentication)
82+
- `USERNAME`: Username for authentication (if using username/password authentication)
83+
- `PASSWORD`: Password for authentication (if using username/password authentication)
84+
85+
---
86+
87+
## Client Configuration
88+
89+
### Prerequisites
90+
91+
Download and install the latest version of [Node.js](https://nodejs.org/en/download/) if you don't already have it installed.
92+
You can check your installed version by running:
893

994
```bash
10-
# Clone the repository
11-
git clone [repository-url]
95+
node -v # Should print "v22" or higher
96+
nvm current # Should print "v22" or higher
97+
```
1298

13-
# Install dependencies
14-
npm install
99+
### Supported Clients
15100

16-
# Build all packages
17-
npm run build
101+
This server has been tested with Claude Desktop, Cursor, GitHub Copilot, and Windsurf clients.
102+
It is expected to work with any MCP client that supports the Model Context Protocol.
103+
104+
> **Note:** Due to the nature of management API calls and the variety of server tools, using this server may require a paid subscription to the model provider to support token limits and context window sizes.
105+
> For smaller models, you can reduce token usage by limiting the number of enabled tools in the client.
106+
107+
### Smart-1 Cloud Example
108+
109+
```json
110+
{
111+
"mcpServers": {
112+
"quantum-management": {
113+
"command": "npx",
114+
"args": ["@chkp/quantum-management-mcp"],
115+
"env": {
116+
"API_KEY": "YOUR_API_KEY",
117+
"S1C_URL": "YOUR_S1C_URL" // e.g., https://xxxxxxxx.maas.checkpoint.com/yyyyyyy/web_api
118+
}
119+
}
120+
}
121+
}
18122
```
19123

20-
## Running MCP Servers
124+
### On-Prem Management Example
21125

22-
To run any of the MCP servers in this repository:
126+
```json
127+
{
128+
"mcpServers": {
129+
"quantum-management": {
130+
"command": "npx",
131+
"args": ["@chkp/quantum-management-mcp"],
132+
"env": {
133+
"MANAGEMENT_HOST": "YOUR_MANAGEMENT_IP_OR_HOST_NAME",
134+
"MANAGEMENT_PORT": "443", // optional, default is 443
135+
"API_KEY": "YOUR_API_KEY", // or use USERNAME and PASSWORD
136+
"USERNAME": "YOUR_USERNAME", // optional
137+
"PASSWORD": "YOUR_PASSWORD" // optional
138+
}
139+
}
140+
}
141+
}
142+
```
143+
144+
> Set only the environment variables required for your authentication method.
145+
146+
### Configuring the Claude Desktop App
23147

24-
1. Navigate to the specific server package directory
25-
2. Follow the instructions in that package's README.md
26-
3. When installing dependencies or running npm/npx commands, make sure to include the registry argument:
148+
#### For macOS:
27149

28150
```bash
29-
--registry https://artifactory-product.checkpoint.com/artifactory/api/npm/npm/
151+
# Create the config file if it doesn't exist
152+
touch "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
153+
154+
# Open the config file in TextEdit
155+
open -e "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
30156
```
31157

32-
### For example, to run the Management MCP server:
33-
``` json
34-
"quantum-management":
35-
{
158+
#### For Windows:
159+
160+
```cmd
161+
code %APPDATA%\Claude\claude_desktop_config.json
162+
```
163+
164+
Add the server configuration:
165+
166+
```json
167+
{
168+
"mcpServers": {
169+
"quantum-management": {
170+
"command": "npx",
171+
"args": ["@chkp/quantum-management-mcp"],
172+
"env": {
173+
// Add the configuration from the above instructions
174+
}
175+
}
176+
}
177+
}
178+
```
179+
180+
### VSCode
181+
182+
Enter VSCode settings and type "mcp" in the search bar.
183+
You should see the option to edit the configuration file.
184+
Add this configuration:
185+
186+
```json
187+
{
188+
...
189+
"mcp": {
190+
"inputs": [],
191+
"servers": {
192+
"quantum-management": {
36193
"command": "npx",
37-
"args":
38-
[
39-
"--registry",
40-
"https://artifactory-product.checkpoint.com/artifactory/api/npm/npm/",
41-
"-y",
42-
"@chkp/genai-mcp-server-management@latest"
194+
"args": [
195+
"@chkp/quantum-management-mcp"
43196
],
44-
"env":
45-
{
46-
"S1C_URL": YOUR_S1C_URL, // (for smart1-cloud)
47-
"MANAGEMENT_HOST": YOUR_MANAGEMENT_HOST, // (for on-prem)
48-
"API_KEY": YOUR_API_KEY,
49-
"USERNAME": YOUR_USERNAME,
50-
"PASSWORD": YOUR_PASSWORD,
197+
"env": {
198+
"MANAGEMENT_HOST": "YOUR_MANAGEMENT_IP_OR_HOST_NAME",
199+
"MANAGEMENT_PORT": "443", // optional, default is 443
200+
"API_KEY": "YOUR_API_KEY", // or use USERNAME and PASSWORD
201+
"USERNAME": "YOUR_USERNAME", // optional
202+
"PASSWORD": "YOUR_PASSWORD" // optional
51203
}
204+
}
52205
}
206+
},
207+
...
208+
}
53209
```
54-
## Available MCP Servers
55210

56-
The following table lists all available MCP servers in this repository:
211+
### Windsurf
57212

58-
| Server | Internal Package | External Package |
59-
|--------|-----------------|-----------------|
60-
| Management | @chkp/genai-mcp-server-management@latest | @chkp/quantum_management_mcp |
213+
Enter Windsurf settings and type "mcp" in the search bar.
214+
You should see the option to edit the configuration file.
215+
Add the configuration as Claude Desktop App.
61216

62-
## Repository Structure
217+
### Cursor
63218

64-
This monorepo is organized as follows:
65-
66-
- `/packages` - Contains all MCP server implementations and shared libraries
67-
- `/infra` - Shared infrastructure components
68-
- `/management` - Management MCP server
219+
Enter Cursor settings and click on "MCP Servers" in the left menu.
220+
You should see the option to add a new MCP Server.
221+
Add the configuration as Claude Desktop App.
222+
223+
---
69224

70225
## Development
71226

72-
For development instructions, please refer to the README within each package directory.
227+
### Prerequisites
228+
229+
- Node.js 22+
230+
- npm 10+
231+
232+
### Setup
233+
234+
```bash
235+
# Install all dependencies
236+
npm install
237+
```
238+
239+
### Build
240+
241+
```bash
242+
# Build all packages
243+
npm run build
244+
```
245+
246+
### Running Locally
247+
248+
You can run the server locally for development using [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) or any compatible MCP client.
249+
250+
```bash
251+
node FULL_PATH_TO_SERVER/packages/management/dist/index.js --s1c-url|--management-host --api-key|--username|--password
252+
```
253+
254+
---
255+
256+
## ⚠️ Security Notice
73257

258+
1. **Authentication keys and credentials are never shared with the model.** They are used only by the MCP server to authenticate with your Check Point management system.
259+
2. **Only use client implementations you trust.** Malicious or untrusted clients could misuse your credentials or access data improperly.
260+
3. **Management data is exposed to the model.** Ensure that you only use models and providers that comply with your organization’s policies for handling sensitive data and PII.

0 commit comments

Comments
 (0)