Check Point Quantum Management MCP Server
Check Point Quantum Management MCP Server is an official Check Point Model Context Protocol server for querying security policies, rulebases, objects, VPN, NAT, and network topology data. It helps AI agents analyze complex Check Point management environments, identify risky rules, support compliance reviews, and generate structured security insights while using credentials only inside the MCP server process.
Overview
Check Point Quantum Management MCP Server is part of Check Point's official open-source MCP server collection for security platforms. The server connects MCP-capable AI clients to Check Point Smart-1 Cloud or on-premises Quantum Security Management environments so an agent can reason over installed policies, rulebases, objects, NAT, VPN, and network topology without building a custom Check Point API integration.
What the MCP server enables
The server is designed for security management analysis and policy review. It can query and visualize installed policies, retrieve and analyze access, NAT, and VPN rules, and inspect objects such as hosts, networks, services, and VPN communities. Practical workflows include identifying rules that allow overly broad traffic, reviewing internet-facing access, tracing whether a host can reach a destination under current policy, and generating structured summaries for audit or operations teams.
Because this MCP server exposes management data to the AI client, its actual reach depends on the Check Point account, API key, or administrator permissions configured for the server. It should be scoped to the minimum management permissions required for the task.
When to use it
Use this server when an AI assistant needs live Check Point policy context for security operations, compliance checks, change review, or firewall optimization. Example tasks include asking whether gateways meet policy requirements, finding unused or disabled rules, mapping allowed and blocked services, or producing a report of risky access patterns across rulebases.
Connection and authentication
The primary connection mode is local stdio using npx @chkp/quantum-management-mcp. The server supports Smart-1 Cloud authentication with API_KEY and S1C_URL, or on-premises management authentication with MANAGEMENT_HOST, optional MANAGEMENT_PORT, and either API_KEY or USERNAME and PASSWORD. Node.js 20 or later is required.
Streamable HTTP is also supported for hosted or multi-user deployments by setting MCP_TRANSPORT_TYPE=http and MCP_TRANSPORT_PORT, or by passing the transport flags. The documented HTTP endpoint is /mcp on the chosen host and port.
Key considerations
Check Point notes that the HTTP transport has no built-in authentication and no TLS, so it should only be used behind an authenticated TLS-terminating reverse proxy. For local use with Claude Desktop, Cursor, GitHub Copilot, Windsurf, or similar MCP clients, the default stdio transport avoids exposing an unauthenticated network listener. Credentials are used by the MCP server to authenticate with Check Point management and are not intentionally shared with the model, but queried management data is exposed to the AI client. Anonymous usage telemetry can be disabled with TELEMETRY_DISABLED=true or the --no-telemetry flag.
Supported Transports
stdio
Command: npx
Args:
@chkp/quantum-management-mcp
streamable_http
URL: http://localhost:3000/mcp
Frequently Asked Questions
- When should an AI agent use this MCP server?
- Use it when an AI agent needs live Check Point Quantum Management context for firewall policy review, rulebase analysis, topology questions, access-path analysis, compliance support, or security operations reporting.
- What does this MCP server add to an AI agent's capabilities?
- It gives the agent structured access to Check Point management data such as installed policies, rulebases, access rules, NAT rules, VPN-related data, network objects, services, and topology information, rather than relying on static product knowledge.
- What can the AI agent access or manage through this server?
- The agent can query and inspect Check Point security policies, rules, objects, VPN communities, NAT configuration, and network topology according to the configured Smart-1 Cloud or on-premises management credentials. Its access is limited by the permissions of the API key or administrator account used by the server.
- How is authentication configured for this MCP server?
- For Smart-1 Cloud, configure `API_KEY` and `S1C_URL`. For on-premises Quantum Management, configure `MANAGEMENT_HOST`, optional `MANAGEMENT_PORT`, and either `API_KEY` or `USERNAME` and `PASSWORD`. Use the least-privileged Check Point account or API key suitable for the workflow.
- Which transport should be used for this MCP server?
- Use `stdio` for local desktop and IDE clients because it is the default documented mode. Use `streamable_http` only for hosted or multi-user deployments, and place it behind an authenticated reverse proxy with TLS because the server's HTTP mode does not provide built-in authentication or encryption.