Tufin MCP Server - Open Source Community Project

Name: Tufin MCP Server - Open Source Community Project
Author: stonecircle82

@stonecircle82

Repository

About Tufin MCP Server - Open Source Community Project

Bridge Tufin APIs to AI workflows: An open-source REST server with RBAC for SecureTrack and SecureChange integration.

#python #devops #automation #ai #server #rest-api #mcp #rbac #copilot #tufin #chatgpt #mcp-server #mcp-client #securetrack #securechange #ai-integraiton

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "tufin-mcp": {
      "command": "python",
      "args": [
        "-m",
        "venv",
        "venv"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Tufin MCP Server - Open Source Community Project?

The Tufin MCP Server bridges Tufin's SecureTrack and SecureChange APIs with modern AI workflows. It provides a secure, standardized REST API with Role-Based Access Control (RBAC) for integrating Tufin data and actions into custom scripts, applications, and AI agents.

How to use Tufin MCP Server - Open Source Community Project?

Clone the repository, create a Python virtual environment, install dependencies, configure environment variables (for Tufin connection and API keys), and run the server locally with Uvicorn or via Docker. Clients authenticate by passing an API key in the X-API-Key header.

Key features of Tufin MCP Server - Open Source Community Project

Standard REST/JSON API with OpenAPI documentation.
Centralized Tufin authentication using Basic Auth.
API key authentication with bcrypt hashing.
Configurable Role-Based Access Control (Admin, Ticket Manager, User).
Endpoints for SecureChange ticketing, SecureTrack devices, and topology.
Structured JSON logging with request IDs.
IP-based rate limiting (default 60 requests/minute).
Docker support and a basic Python client library.

Use cases of Tufin MCP Server - Open Source Community Project

Integrate Tufin change management and topology queries into AI chatbots or agents.
Automate firewall rule creation and ticket management from custom scripts.
Centralize access to Tufin APIs with added security and role enforcement.
Query SecureTrack topology paths and retrieve visual network maps via REST.
Bulk import and manage devices from management platforms like DGs or ADOMs.

FAQ from Tufin MCP Server - Open Source Community Project

What are the prerequisites for running the server?

Python 3.8+ and access to running Tufin SecureTrack and SecureChange instances (v25.1 compatible). Docker is optional for containerized deployment.

How does authentication work?

Clients provide an API key via the X-API-Key header. Keys are hashed with bcrypt and stored in an in‑memory store (for development) or a secure production store. Each key has a role that determines endpoint access via RBAC.

How can I customize Role-Based Access Control?

Modify the ENDPOINT_PERMISSIONS dictionary in src/app/core/config.py to assign roles (admin, ticket_manager, user) to each permission ID. Endpoints use require_permission() to enforce these permissions.

Is SSL verification supported for Tufin connections?

Yes, set TUFIN_SSL_VERIFY to True (default) to verify certificates. Disabling it (False) is insecure and only recommended for environments with self‑signed certificates.

What are the rate limits and how are they applied?

Default rate limit: 60 requests per minute per IP address. Exceeding this returns HTTP 429. The limit is enforced through IP‑based rate limiting middleware.