# PAN-OS MCP for AI Agents AI Agent Connect

> PAN-OS MCP connects your firewall to your AI agent. It lets you audit security rules, check system health, monitor active sessions, and manage configuration commits directly through your AI client. No more jumping between tabs to find logs or verify pending changes.

## Overview
- **Category:** other
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_83HmcpYgcle8KqQOcz9GWLbtyUqjN3KZeuMd25f4/ai-agent-connect

## Description

PAN-OS MCP gives your AI agent direct access to your firewall's configuration and logs. Instead of logging into a separate management console to hunt for data, you can just ask your agent to do the heavy lifting. You can pull threat logs to see who is trying to break in, check your NAT rules to fix a broken connection, or see if your hardware is running the latest version. It turns your firewall into a conversational tool where you can audit security policies or check active sessions without leaving your current workspace. By adding this to your toolkit on Vinkius, you make it way easier to keep your network secure while spending less time clicking through menus. You get a clear view of your network's health and security status whenever you need it, making your daily routine much faster.

## Tools

### get_active_sessions
Lists all current network sessions on the firewall. Use this to spot heavy traffic or debug connections.

### get_nat_rules
Lists all configured NAT rules. Use this to audit your translation policies or fix connectivity issues.

### commit
Validates and activates your candidate configuration. Use this to push your changes live.

### get_pending_changes
Shows uncommitted changes in the candidate configuration. Use this to double-check your work before committing.

### get_security_rules
Lists all security rules on the firewall. Use this to audit policies and review access controls.

### get_system_info
Retrieves the current status and version of the PAN-OS firewall. Use this to check overall system health.

### get_threat_logs
Pulls recent threat logs including IPs and actions taken. Use this to investigate security incidents.

### get_traffic_logs
Retrieves recent traffic logs with optional limits. Use this to analyze patterns or find blocked connections.

## Prompt Examples

**Prompt:** 
```
Who is currently using the most bandwidth on our network?
```

**Response:** 
```
I've checked the active sessions on the firewall. Here are the top users by data volume:

| Source IP | Session ID | Data Transferred |
| --- | --- | --- |
| 192.168.1.45 | 0x882f | 4.2 GB |
| 10.0.4.12 | 0x91ac | 1.8 GB |
| 192.168.1.102 | 0x772b | 850 MB |

It looks like **192.168.1.45** is the primary consumer.
```

**Prompt:** 
```
Show me the latest threat logs from the last hour.
```

**Response:** 
```
I've retrieved the recent threat logs. Here is what the firewall blocked in the last hour:

*   **Source:** 185.22.144.10 $\rightarrow$ **Action:** Blocked (SQL Injection attempt)
*   **Source:** 45.12.99.201 $\rightarrow$ **Action:** Blocked (Malware callback)
*   **Source:** 103.44.1.5 $\rightarrow$ **Action:** Blocked (Port scan)

All threats were handled automatically by the security policy.
```

**Prompt:** 
```
What changes am I about to commit to the firewall?
```

**Response:** 
```
The candidate configuration contains the following pending changes:

*   **Security Rule:** Added a new 'Allow' rule for the HR portal (Port 443).
*   **NAT Rule:** Updated the translation for the VPN gateway.
*   **System:** Updated the DNS server IP to 8.8.8.8.

Would you like me to activate these now?
```

## Capabilities

### Audit security rules
Pull all firewall policies to find gaps or redundant entries.

### Monitor real-time traffic
See active network sessions to identify heavy users or troubleshoot lag.

### Check firewall health
Get instant status updates on the hardware and software versions.

### Review threat logs
Pull recent security incidents including source IPs and threat types.

### Manage configuration commits
Validate and activate changes to the running configuration.

### Audit NAT rules
View all Network Address Translation rules for connectivity troubleshooting.

### Verify pending changes
See what's waiting in the candidate configuration before you commit.

## Use Cases

### Identifying bandwidth hogs
A user reports a slow connection. Use get_active_sessions to see if one specific IP is hogging all the bandwidth.

### Conducting security audits
A security audit is due. Use get_security_rules to list all policies and find any allow all risks.

### Investigating security threats
An attacker is suspected. Use get_threat_logs to identify the source IPs and the specific actions the firewall took.

### Verifying configuration changes
A new policy needs to go live. Use get_pending_changes to review the candidate config before calling commit.

## Benefits

- Faster incident response by pulling threat logs using get_threat_logs to see attacker IPs without manual filtering.
- Simplified security audits by using get_security_rules and get_nat_rules to get a full picture of your network policies in seconds.
- Pre-commit validation by checking your work with get_pending_changes before using commit to ensure no mistakes go live.
- Real-time network visibility by using get_active_sessions to spot issues before users start complaining about slow speeds.
- Quick hardware checks by getting a status update on your firewall versions and health with get_system_info.

## How It Works

The bottom line is you get a conversational interface for your firewall operations without the manual navigation.

1. Connect your PAN-OS management credentials to the Connector via the Vinkius dashboard.
2. Select your preferred AI client and authorize the connection.
3. Start asking your agent to pull logs, check rules, or summarize system status.

## Frequently Asked Questions

**Can the PAN-OS MCP help me with security audits?**
Yes, it can pull all your security rules and NAT configurations so you can review them quickly without manual navigation.

**How does the PAN-OS MCP handle threat logs?**
It retrieves recent threat data, including source IPs, threat names, and the actions the firewall took to block them.

**Can I use the PAN-OS MCP to see who is online?**
You can use it to list all active network sessions, which helps identify heavy users or troubleshoot connection issues.

**Is the PAN-OS MCP safe for making configuration changes?**
It allows you to see pending changes first so you can verify everything before you choose to activate them.

**Can the PAN-OS MCP check my firewall's health?**
Yes, it can pull system information like software versions and current status to ensure your hardware is running correctly.