Illumio MCP Server

alexgoller/illumio-mcp-server

Illumio MCP服务器是一个提供与Illumio策略计算引擎(PCE)交互接口的服务，支持通过对话式AI管理负载、标签和流量分析。

安装

docker run -i --init --rm \

客户端配置

{
  "mcpServers": {
    "illumio-mcp-docker": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--init",
        "--rm",
        "-v",
        "/Users/YOUR_USERNAME/tmp:/var/log/illumio-mcp",
        "-e",
        "DOCKER_CONTAINER=true",
        "-e",
        "PYTHONWARNINGS=ignore",
        "--env-file",
        "/Users/YOUR_USERNAME/.illumio-mcp.env",
        "illumio-mcp:latest"
      ]
    }
  }
}

环境变量

MCP_PUBLIC_URLMCP_OAUTH_ISSUERMCP_OAUTH_JWKS_URLMCP_OAUTH_AUDIENCEMCP_OAUTH_REQUIRED_SCOPEMCP_PCE_MODEPCE_HOSTPCE_PORTPCE_ORG_IDAPI_KEYAPI_SECRETMCP_KEK

GitHub 星标: 1
作者: @alexgoller
分类: 开发者工具, 安全
许可证: GPL-3.0
更新于: 2026年10月6日

工具（40）

get-workloads
Retrieve workloads with optional filtering by name, hostname, IP, labels, and max results
create-workload
Create an unmanaged workload with name, IP addresses, and labels
update-workload
Update an existing workload's properties
delete-workload
Remove a workload from PCE
get-labels
Retrieve labels with optional filtering by key, value, and max results
create-label
Create a new label with key-value pair
update-label
Update an existing label
delete-label
Remove a label
get-rulesets
Get rulesets with optional filtering by name, description, and enabled status
create-ruleset
Create a new ruleset with scopes
update-ruleset
Update ruleset properties
delete-ruleset
Remove a ruleset
create-deny-rule
Create a deny rule (regular or override deny) in a ruleset
update-deny-rule
Update an existing deny rule
delete-deny-rule
Remove a deny rule
get-iplists
Get IP lists with optional filtering by name, description, FQDN, and max results
create-iplist
Create a new IP list
update-iplist
Update an existing IP list
delete-iplist
Remove an IP list
get-services
Get services with optional filtering by name, port, protocol, and max results
create-service
Create a new service definition
update-service
Update an existing service
delete-service
Remove a service
get-traffic-flows
Get detailed traffic flow data with filtering by date range, source/destination, service, policy decision, and more
get-traffic-flows-summary
Get aggregated traffic summaries grouped by app, env, port, and protocol
create-ringfence
Automated app-to-app segmentation policy creation.
identify-infrastructure-services
Discover which apps are infrastructure services by analyzing traffic patterns.
Provider
In-degree
Consumer
Out-degree
provision-policy
Provision pending draft changes to move them from draft to active state.
compare-draft-active
Compare draft vs active policy to preview what would change on provisioning.
enforcement-readiness
Assess whether an app is ready for enforcement.
ringfence-batch
Ringfence multiple apps at once.
get-workload-enforcement-status
Get enforcement mode status across workloads, grouped by app and environment.
get-policy-coverage-report
Generate a policy coverage report for an app showing what traffic is covered by existing rules vs what would be blocked.
find-unmanaged-traffic
Find traffic involving unmanaged workloads or IP addresses.
detect-lateral-movement-paths
Detect potential lateral movement paths by analyzing app-to-app traffic patterns.
compliance-check
Check policy compliance against frameworks (PCI-DSS, NIST 800-53, CIS Controls, or general best practices).
get-events
Get PCE events with optional filtering by event type, severity, status, and result limits
check-pce-connection
Verify PCE connectivity and credentials