MCP Gateway

Overview

coreX Manager includes a built-in Model Context Protocol (MCP) gateway that allows AI agents to interact with coreX Manager’s API using the MCP standard. This enables AI-powered automation, monitoring, and configuration management.

What is MCP?

The Model Context Protocol (MCP) is a standard protocol for connecting AI agents to external tools and data sources. coreX Manager’s MCP gateway exposes coreX Manager’s configuration and monitoring capabilities as MCP tools that AI agents can call.

Enabling the MCP Gateway

1. Navigate to Management > MCP Gateway
2. Toggle Enable MCP Gateway
3. Configure the authentication settings
4. Save

Authentication

The MCP gateway supports token-based authentication. Each MCP client uses an API token to authenticate:

1. Navigate to Management > MCP Gateway > Tokens
2. Click Generate Token
3. Name the token (e.g. my-ai-agent)
4. Copy the token (it won’t be shown again)
5. Use the token in your MCP client configuration

Available Tools

The MCP gateway exposes coreX Manager’s capabilities as tools:

Configuration Tools

Tool	Description
list_listeners	List all listeners
get_listener	Get a specific listener’s configuration
create_listener	Create a new listener
update_listener	Update a listener
delete_listener	Delete a listener
list_backends	List all backends
get_backend	Get a specific backend
create_backend	Create a new backend
update_backend	Update a backend
delete_backend	Delete a backend

Security Tools

Tool	Description
list_security_rules	List security rules
create_security_rule	Create a security rule
list_security_lists	List security lists
list_waf_rules	List WAF rules
get_risk_score	Get current risk scoring configuration

Monitoring Tools

Tool	Description
get_metrics	Get HAProxy metrics
get_waf_metrics	Get WAF metrics
get_access_logs	Get recent access logs
get_audit_events	Get recent audit events

Config Lifecycle Tools

Tool	Description
apply_config	Apply pending configuration changes
revert_config	Revert to a previous snapshot
list_snapshots	List config snapshots

Connecting an AI Agent

Example: Claude Desktop

Add the following to your Claude Desktop configuration:

{
  "mcpServers": {
    "corex-manager": {
      "url": "https://corex.example.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-mcp-token>"
      }
    }
  }
}

Example: Custom MCP Client

from mcp import Client

client = Client(
    url="https://corex.example.com/mcp",
    headers={"Authorization": "Bearer <your-mcp-token>"}
)

# List all listeners
listeners = await client.call_tool("list_listeners", {})

# Create a new backend
await client.call_tool("create_backend", {
    "name": "new-backend",
    "servers": [
        {"name": "server1", "address": "10.0.0.1", "port": 8080}
    ],
    "algorithm": "roundrobin"
})

# Apply changes
await client.call_tool("apply_config", {"comment": "Added new-backend via MCP"})

Use Cases

Automated Incident Response

An AI agent can:

1. Monitor WAF metrics via get_waf_metrics
2. Detect a spike in attacks
3. Create a security rule to block the attacking IPs
4. Apply the configuration

Configuration Auditing

An AI agent can:

1. List all listeners and backends
2. Check for misconfigurations (e.g. no TLS, no health checks)
3. Suggest fixes
4. Apply fixes after human approval

Traffic Analysis

An AI agent can:

1. Fetch access logs
2. Analyze traffic patterns
3. Identify anomalies
4. Recommend rate limit or security rule changes

Step-by-Step: Connect an AI Agent

1. Enable the MCP Gateway:

   • Navigate to Management > MCP Gateway
   • Toggle Enable MCP Gateway
   • Save

2. Generate a token:

   • Click Generate Token
   • Name it (e.g. ops-agent)
   • Copy the token

3. Configure your AI agent:

   • Add the MCP server URL and token to your agent’s configuration
   • URL: https://your-corex-domain/mcp
   • Header: Authorization: Bearer <token>

4. Test the connection:

   • Ask your AI agent to list listeners
   • Verify it can call list_listeners and receive results

5. Try a configuration change:

   • Ask the agent to create a test backend
   • Verify the backend appears in the UI
   • Have the agent apply the config
   • Verify the config is applied

Verification

1. Check the MCP gateway is running:

   curl -k https://localhost/mcp/health

   Expect a 200 response.

2. Test authentication:

   curl -k -H "Authorization: Bearer <token>" https://localhost/mcp/tools

   Expect a list of available tools.

3. Test a tool call:

   curl -k -X POST -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"tool": "list_listeners", "args": {}}' \
     https://localhost/mcp/call

4. Check audit logs:

   • MCP tool calls that modify configuration appear in the audit log
   • Navigate to Observability > Audit Logs and filter for MCP-originated changes

Next Steps

• Users & Settings — Manage API tokens and user access
• Audit & Snapshots — Track MCP-originated changes
• Quick Start — Get started with coreX Manager