Open-source tools for people who run firewalls — self-hosted, offline-capable, no mandatory SaaS.
This supervised agent session used read-only MCP connections to the labs to produce an anonymous point-in-time candidate. Deterministic validation rejects candidates containing names, addresses, or identifiers; it never receives raw identifiers or removes them. The website never connects to the private lab.
A fabricated Junos config and what fwconfigsanitizer gives back. It is one HTML file that runs offline in your browser, and it also handles PAN-OS, FortiGate, ASA and Check Point.
set system host-name edge-fw-chi01 set system root-authentication encrypted-password "$6$k3yS4lt$Qm9ndXNIYXNoRm9yRGVtb09ubHkxMjM0NTY3ODk" set snmp community pr1v4teC0mm authorization read-only set interfaces ge-0/0/0 description "Uplink to Northwind ISP circuit 4471" set interfaces ge-0/0/0 unit 0 family inet address 64.39.102.18/29 set interfaces ge-0/0/1 unit 0 family inet address 10.20.30.1/24 set security zones security-zone trust-corp interfaces ge-0/0/1.0 set system ntp server ntp1.northwind-corp.com
set system host-name sanitized-fw set system root-authentication encrypted-password "REDACTED_HASH_0" set snmp community REDACTED_COMMUNITY_0 authorization read-only set interfaces ge-0/0/0 description SANITIZED_DESC_0 set interfaces ge-0/0/0 unit 0 family inet address 192.0.2.163/29 set interfaces ge-0/0/1 unit 0 family inet address 10.96.205.113/24 set security zones security-zone zone-0 interfaces ge-0/0/1.0 set system ntp server host-0.example.net
Junos · 8 replaced: 2 IPs, 2 secrets, 2 hostnames, 2 other
Best-effort and provided as is: review the output before you share it.
Deterministic decides. The model explains. A human approves.
"Sovereign" is not a slogan here — it is a design constraint every mechub tool is built against.
MIT licensed. Read the code before you point it at a firewall — we would. Every repo is public from the first commit.
AI is optional. The tools make no AI calls of their own, except mechubbench, which benchmarks a model you point it at, and the converter's opt-in assistant, which can use a local model (Ollama, LM Studio) or, if you choose, a cloud provider such as Claude or OpenAI — config text then goes to that provider. Its Local Only and No-AI modes keep everything on your machine. Detection logic and device changes stay deterministic — an LLM never makes a safety-relevant decision on its own.
Everything below is early. It works in our lab against real gear; we need it to work in yours. Stats refresh live from GitHub when you're online. Hover over or tab to a card and the repos it depends on, plus the ones built on it, light up with it.
Core libraries that power the MCP server ecosystem. (3 repos)
The shared Rust foundation under mechub's per-vendor firewall mcp servers — bearer-token auth, scopes, attribution and audit, transport hardening, and change control, written once instead of once per vendor. Consumed as a git dependency, not on crates.io.
Async NETCONF client library for Rust — YANG code generation, vendor profiles, connection pooling, and a Terraform-like CLI for declarative network config.
A Rust replacement for Juniper PyEZ — async-first Junos device automation built on rustnetconf. Python wheels: Linux x86_64 only (other platforms build with maturin).
Enterprise MCP servers for vendor platforms, built on the mecmcp foundation. Maturity follows the mecmcp README: beta, alpha, or planned (not usable). (9 repos)
MCP server that lets AI agents operate Juniper Junos and SRX devices (NETCONF) — built on rustez, exercised against a 24-device vSRX lab.
MCP server that lets AI agents operate Palo Alto PAN-OS firewalls — bearer-token device and tool scopes, a guarded candidate-config lifecycle with independent approval, and the same security posture as rustjunosmcp.
Async mcp server for HPE Juniper Security Director Cloud — bounded read tools for discovery, and a prepare/approve/apply path for policy deployment instead of a direct deploy call.
Async mcp server for the HPE Juniper Mist cloud — bearer-token auth, org- and site-scoped tools, bounded responses, and guarded WAN-edge change control.
MCP server for Proxmox VE — one endpoint across many clusters, with destructive work held behind plan, approve and apply.
The UniFi Network member of the family — a curated, scoped, audited mcp surface over the controller API, the same shape rustjunosmcp gives Junos.
Enterprise MCP server for Fortinet FortiGate (then FortiManager) on the mecmcp foundation — scoped access, audited change control.
Enterprise MCP server for OPNsense on the mecmcp foundation — scoped access, audited change control.
Governed threat-intel → firewall feeds: propose, validate, approve, publish — firewalls pull, nothing is committed per indicator.
Security data platforms with MCP-first architecture. (1 repo)
Sovereign Security Data Fabric — a deliberately minimal security data platform where the mcp tool surface is the product, not an afterthought. Vendor syslog normalised through Vector into ClickHouse, self-hosted end to end, with swappable Python store classes (ClickHouse by default). Reference deployment; no quick start.
Agent skills, config conversion, sanitization, and sync utilities. (4 repos)
Agent skills for firewall work — parsing, auditing, and converting configs across Cisco, Fortinet, Palo Alto, and Juniper. Works with Claude Code, Codex, and Hermes so far.
Browser-based conversion of firewall and cloud configs — PAN-OS, FortiGate, Cisco ASA/FTD, Check Point, SonicWall, Huawei USG, AWS/Azure/GCP, and more — into reviewable Juniper SRX output, with an LLM-guided greenfield mode. Always a migration draft requiring review — never production-ready.
Strips private data — addresses, hostnames, secrets — out of a firewall configuration so it can be shared for help or review. Review the output before sharing — validation warnings flag items it may have missed.
Pushes one SRX's config — policies, objects, NAT — out to a fleet of others, so a golden device can drive the rest. It does not follow the "a human approves" model: there is no approval step, so run check and --dry-run first; pushes use commit confirmed.
Network-automation agent benchmarking and evaluation. (1 repo)
Tool-call benchmark corpus and runner for network-automation agents — drives scenarios through local models and scores emitted tool-call sequences. Needs a local OpenAI-compatible endpoint (e.g. Ollama).
Proof ahead of claims. Here is exactly what these tools are today — and what they are not yet.
Everything public here is developed and used in one real lab: a Proxmox cluster running a 24-device Juniper vSRX topology, exercised through real NETCONF sessions, real commits, and real multi-vendor configs.
No mechub tool has been proven at someone else's site. That is precisely the help we are asking for — see below.
Until a 1.0, expect breaking changes; they'll be called out in release notes, not hidden.
Deterministic code decides, models explain, a human approves. That rule does not change as the tools mature.
| Server | Device or software | Basis |
|---|---|---|
| Junos MCP | vSRX 26.2R1.7 | lab |
| UniFi MCP | UniFi Network Application ≥ 10.5.67, UniFi OS Server ≥ 5.1.37 | minimum supported |
Other servers: see each repo's README.
These are goals in active development — not promises. Scope and timing may change; when something ships, it ships on GitHub first and gets announced here.
Open-source repositories spanning the Rust NETCONF stack, the Junos, PAN-OS, Mist, Security Director Cloud and UniFi MCP servers, browser firewall tools, and shared Claude skills. Eighteen listed above (three of them, rustfortimcp, rustopnsmcp and mecfeedmcp, are placeholders: under construction and not usable yet); all taking issues.
Governed threat-intel feeds to firewalls: indicators are proposed, validated, approved and published as versioned feeds that firewalls pull. The repo is public, but it is under construction and not usable yet.
A composable SecOps console: engineers and agents assemble boards over governed MCP data — zone matrices, rule analysis, feed history — and humans act through cross-platform change sets that honour each server's lab-mode or two-person approval. In development and not yet public.
The single most valuable thing you can do is run a tool against your own gear and tell us what happened — especially when the answer is "it broke".
Personal side projects built with the same tooling — not part of the security stack, just things we like having around.
agentofcomply is in active development and not yet public. Watch github.com/mechubsec for the release announcement.