Illumio MCP Server

get-workloads

Retrieve workloads with optional filtering by name, hostname, IP, labels, and max results

create-workload

Create an unmanaged workload with name, IP addresses, and labels

update-workload

Update an existing workload's properties

delete-workload

Remove a workload from PCE

get-labels

Retrieve labels with optional filtering by key, value, and max results

create-label

Create a new label with key-value pair

update-label

Update an existing label

delete-label

Remove a label

get-rulesets

Get rulesets with optional filtering by name, description, and enabled status

create-ruleset

Create a new ruleset with scopes

update-ruleset

Update ruleset properties

delete-ruleset

Remove a ruleset

create-deny-rule

Create a deny rule (regular or override deny) in a ruleset

update-deny-rule

Update an existing deny rule

delete-deny-rule

Remove a deny rule

get-iplists

Get IP lists with optional filtering by name, description, FQDN, and max results

create-iplist

Create a new IP list

update-iplist

Update an existing IP list

delete-iplist

Remove an IP list

get-services

Get services with optional filtering by name, port, protocol, and max results

create-service

Create a new service definition

update-service

Update an existing service

delete-service

Remove a service

get-traffic-flows

Get detailed traffic flow data with filtering by date range, source/destination, service, policy decision, and more

get-traffic-flows-summary

Get aggregated traffic summaries grouped by app, env, port, and protocol

create-ringfence

Automated app-to-app segmentation policy creation.

identify-infrastructure-services

Discover which apps are infrastructure services by analyzing traffic patterns.

Provider

In-degree

Consumer

Out-degree

provision-policy

Provision pending draft changes to move them from draft to active state.

compare-draft-active

Compare draft vs active policy to preview what would change on provisioning.

enforcement-readiness

Assess whether an app is ready for enforcement.

ringfence-batch

Ringfence multiple apps at once.

get-workload-enforcement-status

Get enforcement mode status across workloads, grouped by app and environment.

get-policy-coverage-report

Generate a policy coverage report for an app showing what traffic is covered by existing rules vs what would be blocked.

find-unmanaged-traffic

Find traffic involving unmanaged workloads or IP addresses.

detect-lateral-movement-paths

Detect potential lateral movement paths by analyzing app-to-app traffic patterns.

compliance-check

Check policy compliance against frameworks (PCI-DSS, NIST 800-53, CIS Controls, or general best practices).

get-events

Get PCE events with optional filtering by event type, severity, status, and result limits

check-pce-connection

Verify PCE connectivity and credentials