FortiAnalyzer MCP Server (rstierli/fortianalyzer-mcp) is an MCP server listed on the M8ven Trust Index. It scores 48 out of 100, grade D. It declares 89 tools. No publisher has claimed this listing.

Caution

48/100

FortiAnalyzer MCP Server

Item: FortiAnalyzer MCP Server
Rating: 48
Author: M8ven

Enables AI assistants to interact with FortiAnalyzer for log analysis, reporting, security monitoring, and SOC operations via the JSON-RPC API.

→ rstierli/fortianalyzer-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

rstierli

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Tool descriptions don’t match what handlers do

2 tools describe read intent but their handlers mutate — download_pcap_by_url (line 688: with open(out_file, "wb") as f:); search_and_download_pcaps (line 907: with open(out_file, "wb") as f:)

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: FAZ_PASS, FORTIANALYZER_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes89 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

find_fortianalyzer_tool

Discover FortiAnalyzer tools by operation name/keywords.

execute_advanced_tool

Execute a FortiAnalyzer operation dynamically by tool name.

list_fortianalyzer_categories

List FortiAnalyzer operation categories.

list_device_groups

List all device groups in an ADOM.

list_device_vdoms

List VDOMs for a specific device.

add_device

Add a new device to FortiAnalyzer.

delete_device

Delete a device from FortiAnalyzer.

add_devices_bulk

Add multiple devices to FortiAnalyzer in bulk.

delete_devices_bulk

Delete multiple devices from FortiAnalyzer in bulk.

get_device_info

Get detailed information about a specific device.

search_devices

Search for devices with filters.

get_alerts

Get alert events from FortiAnalyzer.

get_alert_count

Get count of alerts matching criteria.

acknowledge_alerts

Acknowledge one or more alerts.

unacknowledge_alerts

Unacknowledge one or more alerts.

get_alert_logs

Get log entries associated with alerts.

get_alert_details

Get extra details for alerts.

add_alert_comment

Add a comment to an alert.

get_alert_incident_stats

Get alert and incident statistics.

get_alert_handlers

Get event alert-handler (detection-rule) definitions.

run_fortiview

Start a FortiView analytics query.

fetch_fortiview

Fetch FortiView query results by TID.

get_fortiview_data

Get FortiView data with automatic TID handling.

get_top_sources

Get top traffic sources (bandwidth consumers).

get_top_destinations

Get top traffic destinations.

get_top_applications

Get top applications by bandwidth usage.

get_top_threats

Get top security threats detected.

get_top_websites

Get top websites accessed.

get_top_cloud_applications

Get top cloud/SaaS applications (Shadow IT view).

get_policy_hits

Get policy hit statistics.

get_incidents

Get security incidents from FortiAnalyzer.

get_incident

Get a specific incident by ID.

get_incident_count

Get count of incidents matching criteria.

create_incident

Create a new security incident.

update_incident

Update an existing incident.

get_incident_stats

Get incident statistics.

get_ioc_license_state

Get IOC license state.

acknowledge_ioc_events

Acknowledge IOC events.

run_ioc_rescan

Start an IOC rescan.

get_ioc_rescan_status

Get IOC rescan status.

get_ioc_rescan_history

Get IOC rescan history.

run_and_wait_ioc_rescan

Run IOC rescan and wait for completion.

query_logs

Query logs from FortiAnalyzer log database.

get_log_search_progress

Report status of a query_logs pagination handle.

fetch_more_logs

Fetch another page of a previous query_logs search using its handle.

cancel_log_search

Release a pagination handle (and the FAZ task if still alive).

get_log_stats

Get log statistics for an ADOM.

get_log_fields

Get available log fields for a log type -- what you can filter on.

search_traffic_logs

Search traffic logs with common filter criteria.

search_security_logs

Search security logs (IPS, AV, etc.) with common filters.

search_event_logs

Search system event logs.

get_logfiles_state

Get log file state information.

get_pcap_file

Get PCAP file associated with a log entry.

search_ips_logs

Search IPS/attack logs with advanced filtering.

get_pcap_by_session

Download PCAP file for a specific session ID.

download_pcap_by_url

Download PCAP file using a pcapurl from search results.

search_and_download_pcaps

Search for IPS events and download all matching PCAPs.

list_available_pcaps

List IPS events that have PCAP files available.

list_report_layouts

List available report layouts in FortiAnalyzer.

list_report_templates

List available read-only report templates in FortiAnalyzer.

run_report

Run a report in FortiAnalyzer.

fetch_report

Fetch report status and progress by TID.

get_report_data

Download completed report data.

get_running_reports

Get currently running reports.

get_report_history

Get report history - list of generated reports.

run_and_wait_report

Run a report and wait for completion.

save_report

Download, extract, and save a completed report to disk.

get_linked_indicators

Get IOC indicators linked to an alert or an incident.

get_indicator_enrichment

Get IOC reputation/enrichment for an indicator.

get_system_status

Get FortiAnalyzer system status and version information.

get_ha_status

Get FortiAnalyzer High Availability (HA) status.

list_adoms

List all Administrative Domains (ADOMs) in FortiAnalyzer.

get_adom

Get detailed information about a specific ADOM.

list_devices

List all devices registered in an ADOM.

get_device

Get detailed information about a specific device.

list_tasks

List all tasks in FortiAnalyzer.

get_task

Get detailed status of a specific task.

wait_for_task

Wait for a task to complete.

get_api_ratelimit

Get the current API rate limiting configuration.

update_api_ratelimit

Update the API rate limiting configuration.

get_policy_traffic_profile

Get sampled traffic summary per firewall policy.

get_policy_port_analysis

Get bounded port/protocol enumeration per firewall policy.

get_policy_protocol_summary

Get lightweight protocol breakdown per firewall policy.

get_endpoints

Get UEBA endpoint (asset) records from FortiAnalyzer.

get_endpoint_vulnerabilities

Get CVE/vulnerability records for UEBA endpoints.

get_endusers

Get UEBA end-user (identity) records from FortiAnalyzer.

get_endpoint_stats

Get ADOM-wide UEBA endpoint (asset) count stats for a window.

get_enduser_stats

Get ADOM-wide UEBA end-user (identity) count stats for a window.

faz_skill

Run a FortiAnalyzer skill: an opinionated multi-tool orchestration returning a validated, structured result.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configDOCKER_CONTAINER

configFAZ_HOST

configFAZ_USER

🔐 secretFAZ_PASS

configFAZ_ADOM

configFORTIANALYZER_HOSTyour-faz-hostname

configFORTIANALYZER_USERNAME

🔐 secretFORTIANALYZER_PASSWORD=your-password

configFORTIANALYZER_VERIFY_SSLSecurity: Keep =true. For a self-signed FAZ,

configFAZ_VERIFY_SSL

configDEFAULT_ADOM"": "root",

configFAZ_ALLOWED_OUTPUT_DIRS

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

89/89 tools missing one or more hints — find_fortianalyzer_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); execute_advanced_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_fortianalyzer_categories (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +86 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

2 tools describe read intent but their handlers mutate — download_pcap_by_url (line 688: with open(out_file, "wb") as f:); search_and_download_pcaps (line 907: with open(out_file, "wb") as f:)

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

84/89 tool handlers declare input schemas (94%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

76/89 tool handlers wrap calls in try/catch (85%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Tool description accuracy

download_pcap_by_url: description implies read-only but handler writes/deletes/executes; search_and_download_pcaps: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/rstierli/fortianalyzer-mcp?variant=verified)](https://m8ven.ai/mcp/rstierli/fortianalyzer-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 7d05dd3370c0ca74082665450ac93513bca7ea70

code hash: 45439fbc88efffbfd20db99175555d980b796c740942be16664ef10c7a0a09b9

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client