A Model Context Protocol (MCP) server that provides an interface to interact with Illumio PCE (Policy Compute Engine). This server enables
A Model Context Protocol (MCP) server that provides an interface to interact with Illumio PCE (Policy Compute Engine). This server enables programmatic access to
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| get-workloads | Retrieve workloads with optional filtering by name, hostname, IP, labels, and max results |
| create-workload | Create an unmanaged workload with name, IP addresses, and labels |
| update-workload | Update an existing workload's properties |
| delete-workload | Remove a workload from PCE |
| get-labels | Retrieve labels with optional filtering by key, value, and max results |
| create-label | Create a new label with key-value pair |
| update-label | Update an existing label |
| delete-label | Remove a label |
| get-rulesets | Get rulesets with optional filtering by name, description, and enabled status |
| create-ruleset | Create a new ruleset with scopes |
| update-ruleset | Update ruleset properties |
| delete-ruleset | Remove a ruleset |
| create-deny-rule | Create a deny rule (regular or override deny) in a ruleset |
| update-deny-rule | Update an existing deny rule |
| delete-deny-rule | Remove a deny rule |
| get-iplists | Get IP lists with optional filtering by name, description, FQDN, and max results |
| create-iplist | Create a new IP list |
| update-iplist | Update an existing IP list |
| delete-iplist | Remove an IP list |
| get-services | Get services with optional filtering by name, port, protocol, and max results |
| create-service | Create a new service definition |
| update-service | Update an existing service |
| delete-service | Remove a service |
| get-traffic-flows | Get detailed traffic flow data with filtering by date range, source/destination, service, policy decision, and more |
| get-traffic-flows-summary | Get aggregated traffic summaries grouped by app, env, port, and protocol |
| create-ringfence | Automated app-to-app segmentation policy creation. Analyzes traffic flows to discover which remote apps communicate with a target app, then creates a ruleset wi |
| Intra | scope allow rule — all workloads within the app can communicate freely |
| Extra | scope allow rules — each discovered remote app gets an allow rule on All Services |
| any | default) — IP list Any (0.0.0.0/0) as consumer, deny only at destination. Safest. |
| ams | All Workloads as consumer, deny pushed to every managed workload. Broader. |
| ams_and_any | Both. Maximum coverage. |
| Merge-safe | detects existing rulesets and rules, never creates duplicates |
| Dry | run support — preview what would be created without making changes |
| identify-infrastructure-services | Discover which apps are infrastructure services by analyzing traffic patterns. Builds an app-to-app communication graph and uses dual-pattern scoring to recogni |
| provision-policy | Provision pending draft changes to move them from draft to active state. Can provision all pending changes or specific items by href. Includes change descriptio |
| compare-draft-active | Compare draft vs active policy to preview what would change on provisioning. Shows created, updated, and deleted rulesets, rules, IP lists, and services. |
| enforcement-readiness | Assess whether an app is ready for enforcement. Analyzes traffic flows, existing policy coverage, enforcement modes, and ringfence status. Returns a readiness s |
| ringfence-batch | Ringfence multiple apps at once. Optionally uses identify-infrastructure-services to auto-order apps by infrastructure score (infrastructure first, then standar |
| get-workload-enforcement-status | Get enforcement mode status across workloads, grouped by app and environment. Shows counts per mode (idle, visibility_only, selective, full) and identifies apps |
| get-policy-coverage-report | Generate a policy coverage report for an app showing what traffic is covered by existing rules vs what would be blocked. Breaks down by inbound/outbound, identi |
| find-unmanaged-traffic | Find traffic involving unmanaged workloads or IP addresses. These are sources/destinations without app/env labels, representing policy blind spots. Filters by d |
| detect-lateral-movement-paths | Detect potential lateral movement paths by analyzing app-to-app traffic patterns. Identifies articulation points (bridge nodes) whose compromise would provide a |
| compliance-check | Check policy compliance against frameworks (PCI-DSS, NIST 800-53, CIS Controls, or general best practices). Evaluates segmentation, enforcement modes, high-risk |
| get-events | Get PCE events with optional filtering by event type, severity, status, and result limits |
| check-pce-connection | Verify PCE connectivity and credentials |
{
"mcpServers": {
"illumio-mcp-docker": {
"command": "docker",
"args": [
"run",
"-i",
"--init",
"--rm",
"-v",
"/Users/YOUR_USERNAME/tmp:/var/log/illumio-mcp",
"-e",
"DOCKER_CONTAINER=true",
"-e",
"PYTHONWARNINGS=ignore",
"--env-file",
"/Users/YOUR_USERNAME/.illumio-mcp.env",
"illumio-mcp:latest"
]
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
kubectl with a conversational interface — inspect pods, read logs, diagnose clusters and manage workloads.