Prisma SD-WAN MCP Server

Disclaimer: This project is a personal work developed independently for educational and open-source purposes. It is not an official product of Palo Alto Networks, Inc. or any of its affiliates. All trademarks, service marks, and company names are the property of their respective owners.

A robust Model Context Protocol (MCP) server for Palo Alto Networks Prisma SD-WAN.

This server bridges the gap between AI agents (like Claude, Gemini, or custom LLMs) and your Prisma SD-WAN fabric. It enables secure, read-only access to operational data, allowing agents to perform tasks like inventory audits, health checks, topology analysis, and policy verification through natural language.

Table of Contents

• About
• Features
• Prerequisites
• Installation
• Configuration
• Usage
• Client Integration
• Available Tools
• Architecture
• Troubleshooting
• Contributing
• License

About

The Prisma SD-WAN MCP Server abstracts the complexity of the Prisma SASE API into clean, semantic tools that AI models can understand and call autonomously. Instead of navigating REST endpoints, pagination, and token management, your AI agent simply asks for what it needs.

Core Design Principles:

• Safety First ... Designed as a read-only interface. The only write operation is generate_site_config, which produces a local YAML file. No changes are pushed to your Prisma SD-WAN tenant.
• Simplified Context ... Raw API responses are parsed and trimmed to the fields that matter, keeping LLM context windows lean and focused.
• Multi-Transport ... Supports Stdio (for Claude Desktop and local clients), SSE (for remote/web agents), and Streamable HTTP.
• Container Ready ... Ships with a production-ready Dockerfile for consistent deployments.
• Auto-Reauthentication ... Handles OAuth2 token refresh transparently. Tokens last 15 minutes; the server re-authenticates before they expire.

Features

Prerequisites

• Python 3.10+
• A Prisma SASE tenant with API access enabled
• A Service Account with at least read-only privileges
• Service Account credentials:
• Client ID
• Client Secret
• TSG ID (Tenant Service Group)

Creating a Service Account

1. Log in to the Prisma SASE Portal
2. Navigate to Settings > Identity & Access > Service Accounts
3. Create a new service account with the Prisma SD-WAN app and a read-only role
4. Note down the Client ID, Client Secret, and your TSG ID

Installation

From Source

git clone <repo-url>
cd prisma-sdwan
pip install fastmcp prisma-sase python-dotenv pyyaml jsonschema

Using Docker

docker build -t prisma-sdwan-mcp .

Configuration

Environment Variables

.env File

Create a .env file in the prisma-sdwan/ directory:

[email protected]
PAN_CLIENT_SECRET=abc123-your-secret-here
PAN_TSG_ID=1234567890
PAN_REGION=americas

Security Note: Never commit your .env file to version control. It's already included in .gitignore.

Usage

The server supports three transport modes depending on how your AI client connects.

Stdio Mode (Default)

Best for local integrations like Claude Desktop or CLI-based MCP clients.

python prisma_sdwan_mcp_server.py --transport stdio

SSE Mode

Best for remote or web-based AI agents.

python prisma_sdwan_mcp_server.py --transport sse --host 0.0.0.0 --port 8000

Streamable HTTP Mode

python prisma_sdwan_mcp_server.py --transport streamable-http --host 0.0.0.0 --port 8000

Docker

# Stdio mode (default)
docker run -i --rm \
  -e [email protected] \
  -e PAN_CLIENT_SECRET=your-secret \
  -e PAN_TSG_ID=1234567890 \
  prisma-sdwan-mcp --transport stdio

# SSE mode with port mapping
docker run -d --rm \
  -p 8000:8000 \
  -e [email protected] \
  -e PAN_CLIENT_SECRET=your-secret \
  -e PAN_TSG_ID=1234567890 \
  prisma-sdwan-mcp --transport sse --host 0.0.0.0 --port 8000

Client Integration

Claude Desktop

Add the following to your Claude Desktop MCP configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "prisma-sdwan": {
      "command": "python",
      "args": [
        "/absolute/path/to/prisma_sdwan_mcp_server.py",
        "--transport",
        "stdio"
      ],
      "env": {
        "PAN_CLIENT_ID": "[email protected]",
        "PAN_CLIENT_SECRET": "your-secret",
        "PAN_TSG_ID": "1234567890"
      }
    }
  }
}

With Docker:

{
  "mcpServers": {
    "prisma-sdwan": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "PAN_CLIENT_ID",
        "-e", "PAN_CLIENT_SECRET",
        "-e", "PAN_TSG_ID",
        "prisma-sdwan-mcp",
        "--transport", "stdio"
      ],
      "env": {
        "PAN_CLIENT_ID": "[email protected]",
        "PAN_CLIENT_SECRET": "your-secret",
        "PAN_TSG_ID": "1234567890"
      }
    }
  }
}

Gemini CLI

Add to your settings.json:

{
  "mcpServers": {
    "prisma-sdwan": {
      "command": "python",
      "args": [
        "/absolute/path/to/prisma_sdwan_mcp_server.py",
        "--transport",
        "stdio"
      ],
      "env": {
        "PAN_CLIENT_ID": "[email protected]",
        "PAN_CLIENT_SECRET": "your-secret",
        "PAN_TSG_ID": "1234567890"
      }
    }
  }
}

OpenCode / Other MCP Clients

Any MCP-compatible client can connect using the stdio transport. Point it at prisma_sdwan_mcp_server.py with the --transport stdio argument and supply the required environment variables.

Available Tools

All tools return JSON-formatted data optimized for LLM consumption.

Example Prompts

Once connected, try asking your AI agent:

• "Show me all sites in the SD-WAN fabric."
• "What ION devices are deployed and what software versions are they running?"
• "Pull the BGP peers for the element at site DC-West."
• "Are there any critical alarms right now?"
• "Show me the full network topology."
• "Generate a site config YAML for site ID 12345."
• "List all WAN interfaces at the headquarters site."

Architecture

┌──────────────────┐         ┌──────────────────────┐         ┌─────────────────────┐
│   AI Agent       │  MCP    │  Prisma SD-WAN MCP   │  REST   │  Prisma SASE API    │
│  (Claude, etc.)  │◄──────►│  Server               │◄──────►│  api.sase.palo...   │
│                  │  stdio/ │  prisma_sdwan_mcp_    │  HTTPS  │                     │
│                  │  SSE    │  server.py            │         │                     │
└──────────────────┘         └──────────────────────┘         └─────────────────────┘

The server acts as a translation layer:

1. The AI agent calls an MCP tool (e.g., get_sites)
2. The server maps that call to the appropriate Prisma SASE REST API endpoint
3. It handles authentication, pagination, and error recovery automatically
4. The response is parsed, simplified, and returned as clean JSON

Key Implementation Details:

• Single-file architecture ... all logic lives in prisma_sdwan_mcp_server.py
• OAuth2 authentication via prisma_sase SDK with automatic token refresh
• Auto-reauth on 401/403 responses or token expiry
• Config validation using JSON Schema (schema.json) for generated YAML files

Troubleshooting

Debug Logging

Server logs are written to stderr. To capture them:

python prisma_sdwan_mcp_server.py --transport stdio 2>debug.log

Contributing

Contributions are welcome! Here's how to get started:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/my-new-tool)
3. Follow existing code conventions (single-file architecture, @mcp.tool() pattern)
4. Test against a live or mock Prisma SASE tenant
5. Submit a Pull Request with a clear description of your changes

When adding new tools:

• Place them in prisma_sdwan_mcp_server.py following the @mcp.tool() decorator pattern
• Return json.dumps(data, indent=2) from every tool
• Keep responses trimmed to essential fields for LLM context efficiency

License

This project is licensed under the MIT License.