feat: add certificate management tools - #1
Open
wouter-bon wants to merge 20 commits into
Open
Conversation
Add 11 new MCP tools for managing FortiGate certificates: - list_local_certificates, list_ca_certificates, list_remote_certificates - get_local_certificate_detail, get_ca_certificate_detail, get_remote_certificate_detail - list_crl, get_crl_detail - delete_local_certificate, delete_ca_certificate, delete_remote_certificate API endpoints added: - /api/v2/cmdb/certificate/local - /api/v2/cmdb/certificate/ca - /api/v2/cmdb/certificate/remote - /api/v2/cmdb/certificate/crl Also adds CLAUDE.md with project documentation for Claude Code. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Add automated certificate issuance from Let's Encrypt using Cloudflare DNS-01 challenges, with direct import to FortiGate devices. New tools: - request_certificate: Request Let's Encrypt cert via Cloudflare DNS - request_and_import_certificate: Request and import cert to FortiGate - import_certificate: Import existing certificate to FortiGate - import_ca_certificate: Import CA certificate to FortiGate - list_cloudflare_zones: List available DNS zones - verify_cloudflare_token: Verify Cloudflare API token New modules: - core/acme_client.py: ACME protocol client for Let's Encrypt - core/cloudflare_dns.py: Cloudflare DNS API for DNS-01 challenges - tools/acme.py: MCP tool implementations Also adds ACMEConfig model and certificate import methods to FortiGate API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix account registration for existing accounts (ConflictError handling) - Fix poll() return type handling (tuple vs single value) - Remove unused crypto_util.load_pem_private_key call - Fix datetime timezone handling in certificate info 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Example workflow demonstrating how to call FortiGate MCP server from n8n using HTTP requests with JSON-RPC 2.0 protocol. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add new MCP tools for FortiGate Security Fabric management: - get_security_fabric_config: Get CSF configuration - get_security_fabric_status: Get fabric runtime status - get_fabric_devices: List fabric devices/connectors - get_fabric_connectors: Get SDN connector configuration - get_ha_status: Get HA cluster status - get_ha_config: Get HA configuration - get_fabric_topology: Comprehensive fabric topology view 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add FortiManager JSON-RPC API integration for centralized management: - FortiManagerAPI client class with session/token authentication - FortiManagerManager for multi-instance management - 16 new MCP tools for FortiManager operations: - Manager lifecycle (add, remove, list, test) - System info (status, ADOMs) - Device management (list, status) - Policy packages (list, get policies) - Objects (addresses, services) - Installation (install policy, status) - Certificates and tasks 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add PEM certificate parsing using cryptography library - Extract issuer, subject, validity dates, and Let's Encrypt detection - Add get_all_certificates() method to scan all devices across ADOMs - Add get_all_certificates MCP tool with formatted report output - Enrich certificate metadata when PEM data is available 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add n8n workflows that provide a chat interface for managing FortiGate firewalls and FortiManager through the MCP server: - v1: Initial HTTP Request node approach (uses old /mcp endpoint) - v2: Code node approach with fetch (n8n compatibility issues) - v3: Working version with proper SSE handling and session management The v3 workflow supports: - FortiGate API commands (devices, policies, interfaces, routes, fabric) - FortiManager API commands (ADOMs, devices, certificates) - Session initialization for MCP HTTP transport - SSE response parsing 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix ACME client JWS error when reusing existing Let's Encrypt account by constructing RegistrationResource directly from ConflictError location - Add certificate renewal command to n8n chat workflow - Update workflow to use HTTP Request nodes instead of fetch() - Add comprehensive command list to chat welcome message 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add human-readable formatting for certificates, policies, VIPs, etc. - Show real device name (NLFMFW1A) instead of "default" - Filter certificates by user vs factory - Add device location header to all outputs 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add uv as recommended package manager - Document test markers for unit/integration tests - Add FortiManager, ACMEClient, CloudflareDNS to core layer - Add FabricTools, ACMETools, FortiManagerTools to tools table - Document environment variables for ACME configuration - Add system/csf endpoint for Security Fabric 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add packet capture functionality for FortiGate devices: - Create, start, stop, download, delete, and clear packet captures - Filter by interface, source IP, destination IP, protocol, and port - BPF-style filter string generation Also add device name resolution to base class: - Users can now use device names (e.g., "NLFMFW1A") instead of device IDs - Case-insensitive matching for device names - Applies to all tools that inherit from FortiGateTool New files: - src/fortigate_mcp/tools/packet_capture.py Modified files: - core/fortigate.py: Add packet capture API methods - formatting/formatters.py: Add packet capture formatters - formatting/templates.py: Add packet capture templates - server_http.py: Register packet capture MCP tools - tools/base.py: Add device name resolution - tools/__init__.py: Export PacketCaptureTools 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add timed packet capture with automatic analysis: - capture_and_analyze() runs capture for configurable duration (default 2 min) - Saves PCAP to temporary file for persistence - Analyzes with tshark if available (protocol hierarchy, conversations, endpoints) - Falls back to basic PCAP parsing if tshark not installed - Auto-cleanup of capture profile after analysis - Stops early if max packet count reached 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add PacketCaptureTools to tools table - Document device name resolution feature (DEVICE_NAME_MAP) - Add system/sniffer CMDB and monitor endpoints - Add Packet Capture section explaining capture_and_analyze workflow 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add FortiGateSSHClient for CLI-based packet capture via SSH - Update capture_and_analyze to use SSH 'diagnose sniffer packet' command - Show friendly device names (NLFMFW1A) instead of device IDs in list_devices - Update n8n workflow to use device name mapping for formatted output - Add SSH client documentation to CLAUDE.md 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add "Packet capture" to available commands menu - Prompt user for capture parameters when selected - Parse parameters: interface, duration, host, port, protocol, count - Execute capture_and_analyze with user-specified settings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Detect CIDR notation (/) in host parameter - Use "net" keyword for subnets instead of "host" for single IPs - Update n8n workflow regex to accept subnet notation - Add subnet example to packet capture help text 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add comprehensive IPSec VPN management and diagnostics: - REST API methods for Phase 1/Phase 2 CRUD operations - SSH diagnostic commands (IKE gateways, tunnel stats, up/down) - 18 new MCP tools for VPN troubleshooting - Comprehensive troubleshoot_ipsec_tunnel combining REST + SSH data - Human-readable formatters for all VPN output New tools: list/get/create/update/delete for Phase 1 and Phase 2, get_ipsec_tunnel_status, diagnose_ipsec_ike_gateways, diagnose_ipsec_tunnels, ipsec_tunnel_up/down, clear_ipsec_ike_gateway, troubleshoot_ipsec_tunnel, get_ipsec_vpn_summary 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add comprehensive FortiAnalyzer support following the FortiManager pattern: Core components: - FortiAnalyzerAPI: JSON-RPC client for FortiAnalyzer communication - FortiAnalyzerManager: Multi-instance manager with dynamic registration - FortiAnalyzerTool: Base class for tool implementations - FortiAnalyzerTools: 24 tool implementations Tool categories: - Analyzer management (list, add, remove, test connection) - System info (status, ADOMs) - Device management (devices reporting logs, device status) - Log operations (search, stats, fields, raw logs) - Report operations (list, run, status, download) - FortiView analytics (dashboard, threats, top sources/destinations/apps) - Event management (summary, alerts, acknowledge) Features: - Dynamic registration (no config file required) - Flexible time range syntax (1h, 24h, 7d, today, yesterday) - Multiple log types (traffic, event, security, app-ctrl, etc.) - ADOM support on all operations 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New Certificate Tools
list_local_certificateslist_ca_certificateslist_remote_certificatesget_local_certificate_detailget_ca_certificate_detailget_remote_certificate_detaillist_crlget_crl_detaildelete_local_certificatedelete_ca_certificatedelete_remote_certificateAPI Endpoints Added
/api/v2/cmdb/certificate/local/api/v2/cmdb/certificate/ca/api/v2/cmdb/certificate/remote/api/v2/cmdb/certificate/crlTest plan
🤖 Generated with Claude Code