AI & MCP integrations

Available on: all plan levels

Firezone exposes Model Context Protocol (MCP) tools for AI assistants to read and manage an account. Each tool maps to a REST API operation and acts with the connected admin's identity and granted permissions.

Connection methods

Method	Firezone Cloud US	Firezone Cloud EU	Setup guide
ChatGPT & Codex directory OAuth	Supported	Not supported	ChatGPT & Codex
Claude directory OAuth	Supported	Not supported	Claude
Codex with a direct MCP connection	Supported	Supported	Codex MCP setup
Claude Code with a direct MCP connection	Supported	Supported	Claude Code MCP setup
Other compatible MCP clients	Supported	Supported	Universal MCP

Direct MCP connections also authenticate through OAuth. The US-only limitation applies to the directory integrations; the EU MCP server has its own OAuth authorization server.

Regional endpoints

Region	MCP server	OAuth authorization server
Firezone Cloud US	`https://rest-api.firezone.dev/mcp`	`https://app.firezone.dev`
Firezone Cloud EU	`https://eu.rest-api.firezone.dev/mcp`	`https://eu.app.firezone.dev`

The account, MCP endpoint, and authorization server must belong to the same region. OAuth tokens are bound to the exact regional MCP URL. A token for one region is not valid in the other.

OAuth

Connections require a Firezone admin. The authorization server handles sign-in and consent; the assistant receives access only to the permissions approved on the consent screen. When the client does not request scopes, the consent screen starts with read permissions selected.

Property	Value
Transport	Streamable HTTP
Grant types	Authorization code and refresh token
PKCE	`S256`
Client identification	OAuth Client ID Metadata Documents (CIMD)
Token endpoint authentication	Public clients (`none`) or `private_key_jwt`
Authorization server discovery	`/.well-known/oauth-authorization-server` on the regional portal
Protected resource discovery	`/.well-known/oauth-protected-resource` on the regional REST API host

Firezone does not provide dynamic client registration. A compatible MCP client supports CIMD and the authorization code flow with PKCE. REST API tokens cannot replace MCP OAuth tokens.

Permissions and supported operations

Scopes use the form entity:read or entity:write. For example, resources:read permits Resource lookups, while resources:write permits changes. Write implies read wherever an entity supports both levels.

Entity	Scope levels	Supported operations
`account`	`read`	View account details and limits.
`actors`	`read`, `write`	List, view, create, update, and delete Actors. Admin creation and deletion require the portal.
`groups`	`read`, `write`	List, view, create, update, and delete Groups; replace or update memberships.
`external_identities`	`read`, `write`	List and view linked identities; unlink identities.
`clients`	`read`, `write`	List, view, update, delete, verify, and unverify Clients.
`client_tokens`	`read`, `write`	List and view Client token records; create and revoke Client tokens.
`sites`	`read`, `write`	List, view, create, update, and delete Sites.
`gateways`	`read`, `write`	List, view, create, rename, and delete Gateways. Creation with a token also requires `gateway_tokens:write`.
`gateway_tokens`	`write`	Create, rotate, and revoke Gateway tokens.
`resources`	`read`, `write`	List, view, create, update, and delete Resources; manage pool members.
`policies`	`read`, `write`	List, view, create, update, and delete Policies; inspect available posture fields.
`auth_providers`	`read`	List and view authentication providers.
`directories`	`read`	List and view directories.
`posture_providers`	`read`, `write`	List and view posture providers and synced devices; rename, enable, disable, or delete providers.
`logs`	`read`	Read change, session, flow, and API request logs.

Tools outside the granted scopes are omitted from tool discovery. Scope checks also apply when a tool is called directly. Scopes can restrict the admin's access, but cannot grant more access than the admin already has.

Tools include read-only and write annotations. Whether an assistant asks for confirmation depends on its host's approval settings; annotations do not replace Firezone permission checks.

The REST API reference defines the operations and their parameters.

Activity and credentials

Every tool call is a REST API request, appears in Logs → API Request Logs, and uses the REST API's rate limits.

Client and Gateway token creation returns a live credential to the assistant. Disconnecting the OAuth connection revokes its access, but does not revoke credentials created through it. Those credentials remain valid until revoked separately.

Connections appear under Your settings → Connected apps in the admin portal. Disconnecting a connection requires the assistant to sign in again before it can use Firezone.

Data and privacy

Firezone receives tool requests and returns their results. Firezone does not see or store conversations with the assistant. Tool results are shared with the AI provider and follow that provider's data terms. Firezone handles its own data as described in the privacy policy.

Need help? See all support options.