Manage Firezone from Claude and other AI assistants

Firezone has a Model Context Protocol (MCP) server. Connect it to Claude or another AI assistant to read and manage your Firezone account in plain language. For example, you can ask "Which Resources can the Engineering group access?" or "Create a Policy that gives Contractors access to the staging database."

Each MCP tool is one REST API operation. The assistant acts as you, and it can only do what you allow when you connect it.

Before you begin

• You must be an admin of your Firezone account.
• Use this server URL:

https://rest-api.firezone.dev/mcp

Connect Claude

Claude on the web, desktop, and mobile

1. Open Settings → Connectors.
2. Select Browse connectors and search for Firezone. If Firezone is not in the list, select Add custom connector and enter the server URL above.
3. Select Connect.
4. Sign in and choose permissions.

On Team and Enterprise plans of Claude, an owner of your Claude organization may need to add the connector first.

Claude Code

Run this command, then run /mcp in Claude Code and select firezone to sign in:

claude mcp add --transport http firezone https://rest-api.firezone.dev/mcp

Other MCP clients

Any MCP client that supports the Streamable HTTP transport and OAuth can connect. Enter the server URL. You do not need to create an OAuth client or an API token in Firezone.

Sign in and choose permissions

When you connect, a Firezone page opens in your browser:

1. Enter your account slug, if Firezone asks for it.
2. Sign in with your usual method.
3. Select the permissions the assistant gets. Read permissions are selected by default. Select write permissions only for the things you want the assistant to change.
4. Select Connect.

The assistant can only see the tools that match the permissions you selected. It can never do more than your own admin account can do.

What the assistant can do

The tools cover the same objects as the REST API, such as Resources, Policies, Sites, Gateways, Groups, Actors, Clients, and logs. Each tool is marked as read-only or as a write:

• Read tools only view data. Claude can run these without asking you each time.
• Write tools create, change, or delete data. Claude asks you to confirm each write before it runs.

Some write tools create credentials, such as Client tokens and Gateway tokens. The token is returned to the assistant. If you disconnect the assistant later, tokens that it created stay valid. Delete them in the admin portal if you no longer need them.

Review activity

Every tool call is a REST API request. Go to Logs → API Request Logs in the admin portal to see what the assistant did and when. Tool calls use the same rate limits as the REST API.

Disconnect an assistant

1. In the admin portal, select your user avatar in the upper right, then select Your settings.
2. Under Connected apps, find the assistant and select Disconnect.

This revokes its access at once. The assistant must sign in again to use Firezone.

Data and privacy

The assistant sends each request to Firezone, and Firezone sends the result back to the assistant. Firezone does not see or store your conversations with the assistant. The results that the assistant receives go to your AI provider and follow that provider's data terms. Firezone handles its own data as described in the privacy policy.

Need help? See all support options.