x=hub

your toolset

    build deployment
    sign in

    WatchGuard MCP

    mcpother
    io.github.Servosity/watchguard-mcp · v0.1.1
    deploy just this

    WatchGuard Cloud Firebox, Endpoint Security, ThreatSync, NDR and AuthPoint APIs for every customer

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # once, as root:
docker build -t mcp-local/watchguard:latest https://github.com/servosity/msp-skills.git#:skills/watchguard

#!/usr/bin/env bash
# watchguard (io.github.Servosity/watchguard-mcp), recipe docker (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-watchguard.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec docker run --rm --name mcp-my-agent-watchguard -p 127.0.0.1:${PORT}:8000 --env-file /etc/mcp/my-agent.env mcp-local/watchguard:latest

[Unit]
Description=MCP server watchguard (toolset my-agent), generated by Hub
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
SupplementaryGroups=docker
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/watchguard
WorkingDirectory=/var/lib/mcp/watchguard
ExecStart=/opt/mcp/my-agent/bin/watchguard.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/watchguard

[Install]
WantedBy=multi-user.target
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    docker build -t watchguard https://github.com/servosity/msp-skills.git#:skills/watchguard
docker run --rm -p 127.0.0.1:8101:8000 -e WATCHGUARD_CLIENT_ID -e WATCHGUARD_CLIENT_SECRET -e WATCHGUARD_API_KEY -e WATCHGUARD_ACCOUNT_ID -e WATCHGUARD_BASE_URL -e WATCHGUARD_TOKEN_URL -e WATCHGUARD_AUDIENCE -e WATCHGUARD_OAUTH_SCOPE -e WATCHGUARD_USER_AGENT -e WATCHGUARD_MCP_READ_ONLY -e WATCHGUARD_MCP_HTTP_TOKEN -e PRINTING_PRESS_CLIENT_PROFILE watchguard
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T08:13:13+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
#   cp .env.example .env    # fill the ${VAR}s
#   docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
  watchguard:
    build:
      context: https://github.com/servosity/msp-skills.git#:skills/watchguard
    ports:
    - 127.0.0.1:8101:8000
    restart: unless-stopped
    x-note: 'CHANGE_ME: built from the repository''s Dockerfile, assuming it serves streamable HTTP at
      :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.'
    environment:
      WATCHGUARD_CLIENT_ID: ${WATCHGUARD_CLIENT_ID}
      WATCHGUARD_CLIENT_SECRET: ${WATCHGUARD_CLIENT_SECRET}
      WATCHGUARD_API_KEY: ${WATCHGUARD_API_KEY}
      WATCHGUARD_ACCOUNT_ID: ${WATCHGUARD_ACCOUNT_ID}
      WATCHGUARD_BASE_URL: ${WATCHGUARD_BASE_URL}
      WATCHGUARD_TOKEN_URL: ${WATCHGUARD_TOKEN_URL}
      WATCHGUARD_AUDIENCE: ${WATCHGUARD_AUDIENCE}
      WATCHGUARD_OAUTH_SCOPE: ${WATCHGUARD_OAUTH_SCOPE}
      WATCHGUARD_USER_AGENT: ${WATCHGUARD_USER_AGENT}
      WATCHGUARD_MCP_READ_ONLY: ${WATCHGUARD_MCP_READ_ONLY}
      WATCHGUARD_MCP_HTTP_TOKEN: ${WATCHGUARD_MCP_HTTP_TOKEN}
      PRINTING_PRESS_CLIENT_PROFILE: ${PRINTING_PRESS_CLIENT_PROFILE}
volumes:
  npm-cache: {}
  uv-cache: {}
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T08:13:13+00:00).
#   kubectl create namespace mcp
#   kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
#   kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
  name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: watchguard
  namespace: mcp
  labels: &id001
    app: watchguard
spec:
  replicas: 1
  selector:
    matchLabels: *id001
  template:
    metadata:
      labels: *id001
    spec:
      containers:
      - name: watchguard
        image: CHANGE_ME
        ports:
        - containerPort: 8000
          name: http
        env:
        - name: WATCHGUARD_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_CLIENT_ID
        - name: WATCHGUARD_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_CLIENT_SECRET
        - name: WATCHGUARD_API_KEY
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_API_KEY
        - name: WATCHGUARD_ACCOUNT_ID
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_ACCOUNT_ID
        - name: WATCHGUARD_BASE_URL
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_BASE_URL
        - name: WATCHGUARD_TOKEN_URL
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_TOKEN_URL
        - name: WATCHGUARD_AUDIENCE
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_AUDIENCE
        - name: WATCHGUARD_OAUTH_SCOPE
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_OAUTH_SCOPE
        - name: WATCHGUARD_USER_AGENT
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_USER_AGENT
        - name: WATCHGUARD_MCP_READ_ONLY
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_MCP_READ_ONLY
        - name: WATCHGUARD_MCP_HTTP_TOKEN
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: WATCHGUARD_MCP_HTTP_TOKEN
        - name: PRINTING_PRESS_CLIENT_PROFILE
          valueFrom:
            secretKeyRef:
              name: mcp-credentials
              key: PRINTING_PRESS_CLIENT_PROFILE
---
apiVersion: v1
kind: Service
metadata:
  name: watchguard
  namespace: mcp
spec:
  selector:
    app: watchguard
  ports:
  - port: 8000
    targetPort: http
    name: http
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T08:13:13+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
  watchguard:
    enabled: true
    replicas: 1
    port: 8000
    path: /mcp
    container:
      name: watchguard
      image: CHANGE_ME
      ports:
      - containerPort: 8000
        name: http
      env:
      - name: WATCHGUARD_CLIENT_ID
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_CLIENT_ID
      - name: WATCHGUARD_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_CLIENT_SECRET
      - name: WATCHGUARD_API_KEY
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_API_KEY
      - name: WATCHGUARD_ACCOUNT_ID
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_ACCOUNT_ID
      - name: WATCHGUARD_BASE_URL
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_BASE_URL
      - name: WATCHGUARD_TOKEN_URL
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_TOKEN_URL
      - name: WATCHGUARD_AUDIENCE
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_AUDIENCE
      - name: WATCHGUARD_OAUTH_SCOPE
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_OAUTH_SCOPE
      - name: WATCHGUARD_USER_AGENT
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_USER_AGENT
      - name: WATCHGUARD_MCP_READ_ONLY
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_MCP_READ_ONLY
      - name: WATCHGUARD_MCP_HTTP_TOKEN
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: WATCHGUARD_MCP_HTTP_TOKEN
      - name: PRINTING_PRESS_CLIENT_PROFILE
        valueFrom:
          secretKeyRef:
            name: mcp-credentials
            key: PRINTING_PRESS_CLIENT_PROFILE

# helm install my-agent helm/my-agent -n mcp

    in the cloud

    one click: the provider's deploy form opens filled in, in your own account
    koyeb
    deploy to koyeb

    The form opens with CHANGE_ME for each value you supply: WATCHGUARD_CLIENT_ID, WATCHGUARD_CLIENT_SECRET, WATCHGUARD_API_KEY, WATCHGUARD_ACCOUNT_ID, WATCHGUARD_BASE_URL, WATCHGUARD_TOKEN_URL, WATCHGUARD_AUDIENCE, WATCHGUARD_OAUTH_SCOPE, WATCHGUARD_USER_AGENT, WATCHGUARD_MCP_READ_ONLY, WATCHGUARD_MCP_HTTP_TOKEN, PRINTING_PRESS_CLIENT_PROFILE. Fill them in before you deploy.

    Koyeb builds the repository's Dockerfile from branch main; change the branch in the form if the default one has another name.

    Clients connect to the service's https://…koyeb.app address plus /mcp.

    cloud run
    run on google cloud

    Cloud Shell clones the repository, builds its Dockerfile and deploys it to Cloud Run.

    Cloud Run sends requests to $PORT (8080); the recipe expects :8000, so the server has to read PORT, or set the container port on the service afterwards.

    Set WATCHGUARD_CLIENT_ID, WATCHGUARD_CLIENT_SECRET, WATCHGUARD_API_KEY, WATCHGUARD_ACCOUNT_ID, WATCHGUARD_BASE_URL, WATCHGUARD_TOKEN_URL, WATCHGUARD_AUDIENCE, WATCHGUARD_OAUTH_SCOPE, WATCHGUARD_USER_AGENT, WATCHGUARD_MCP_READ_ONLY, WATCHGUARD_MCP_HTTP_TOKEN, PRINTING_PRESS_CLIENT_PROFILE on the service afterwards: the button asks only for what the repository's own app.json lists.

    connect to it

    copy what your client needs
    {
  "mcpServers": {
    "watchguard": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add watchguard -- CHANGE_ME

    {
  "mcpServers": {
    "watchguard": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    {
  "servers": {
    "watchguard": {
      "type": "stdio",
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.Servosity/watchguard-mcp
    • not probed yet: tools unpinned, ingest lists them
    • no recipe for target 'local': fill the files by hand

    tools

    Not probed yetThe tools appear once the hub or its worker has listed this entry. Running it still works: your client lists them on first start.