LanceHardwoodXXX/BarracudaCGF-MCP

Barracuda CloudGen Firewall MCP Server

A Model Context Protocol (MCP) server for managing Barracuda CloudGen Firewalls through their REST API. This server enables Claude Desktop and other MCP clients to interact with policy-driven Barracuda CloudGen Firewalls.

🎯 Features

• System Monitoring: Real-time health status and system metrics
• Service Management: List and monitor firewall services
• Network Objects: View and filter configured network objects
• Service Objects: Browse and search service definitions
• Policy Status: Check policy-driven configuration status

⚠️ Important Note

This server is optimized for policy-driven Barracuda CloudGen Firewalls. Direct rule manipulation is not available via API in policy-driven mode. Rules must be managed through the Barracuda Control Center.

📋 Prerequisites

• Python 3.11+
• Docker (optional)
• Barracuda CloudGen Firewall with REST API enabled
• API Token for authentication
• Claude Desktop (for MCP integration)

🚀 Quick Start

Option 1: Docker (Recommended)

1. Clone the repository

git clone https://github.com/yourusername/barracuda-cgf-mcp.git
cd barracuda-cgf-mcp

2. Set environment variables

cp .env.example .env
# Edit .env with your firewall details

3. Build and run with Docker

docker build -t barracuda-mcp .
docker run -it --rm \
  -e BARRACUDA_HOST=http://your-firewall:8080 \
  -e BARRACUDA_API_TOKEN=your-token \
  barracuda-mcp

Option 2: Python

1. Install dependencies

pip install -r requirements.txt

2. Set environment variables

export BARRACUDA_HOST="http://your-firewall:8080"
export BARRACUDA_API_TOKEN="your-api-token"

3. Run the server

python barracuda_server.py

🔧 Configuration

Environment Variables

Claude Desktop Integration

Add to your Claude Desktop configuration:

Windows (%APPDATA%\Claude\claude_desktop_config.json):

{
  "mcpServers": {
    "barracuda-cgf": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--name", "barracuda-mcp",
        "-e", "BARRACUDA_HOST=http://your-firewall:8080",
        "-e", "BARRACUDA_API_TOKEN=your-token",
        "barracuda-mcp:latest"
      ]
    }
  }
}

macOS/Linux (~/.config/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "barracuda-cgf": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--name", "barracuda-mcp",
        "-e", "BARRACUDA_HOST=http://your-firewall:8080",
        "-e", "BARRACUDA_API_TOKEN=your-token",
        "barracuda-mcp:latest"
      ]
    }
  }
}

📦 Docker Compose

For production deployments:

docker-compose up -d

🛠️ Available Tools

get_system_status

Returns comprehensive system health information including:

• Server, process, and disk states
• Network and system status
• Security and operative event states
• License information

list_services

Lists all running firewall services, categorized by:

• Core services (boxfw, control, restd)
• Logging services
• Monitoring services

list_network_objects

Displays configured network objects with optional filtering:

• LAN/DMZ networks
• VPN configurations
• System networks
• Custom objects

list_service_objects

Shows service definitions with categorization:

• Web services (HTTP/HTTPS)
• Email services
• Remote access
• VPN services
• Custom services

check_policy_status

Verifies if the firewall uses policy-driven configuration.

📝 Usage Examples

In Claude Desktop, after integration:

• "Show me the firewall system status"
• "List all network objects"
• "What services are running on the firewall?"
• "Filter network objects containing 'VPN'"
• "Check if the firewall uses policy-based rules"

🧪 Testing

Test Connection

curl -H "X-API-Token: your-token" \
     -H "Accept: application/json" \
     "http://your-firewall:8080/rest/control/v1/box?envelope=false"

Run Tests

python -m pytest tests/

🐛 Troubleshooting

Common Issues

Debug Mode

Enable debug logging by setting:

export LOG_LEVEL=DEBUG

🔒 Security

• API tokens are never logged
• Uses HTTPS when configured
• Runs as non-root user in Docker
• Read-only filesystem in container
• Memory limited to 256MB

🤝 Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

📄 License

This project is licensed under the MIT License - see the file for details.

🙏 Acknowledgments

• Model Context Protocol by Anthropic
• Barracuda CloudGen Firewall API Documentation

📞 Support

• Issues: GitHub Issues
• Discussions: GitHub Discussions

⚡ Limitations

Due to policy-driven configuration, the following operations are NOT available:

• Direct firewall rule creation/modification
• VPN tunnel configuration changes
• Interface configuration
• Routing table modifications
• DHCP server configuration

These operations must be performed through the Barracuda Control Center or Web UI.

Note: This project is not affiliated with or endorsed by Barracuda Networks.