forti-cli
forti reads FortiGate configuration and monitor data through the FortiOS REST API, and changes it
through validated, stored plans. It is built on the forti-api
SDK and shares its command engine with forti-mcp, so
AI clients get the same bounded surface as you do at the terminal.
1forti configure # host, CA bundle, API key (hidden) and mode2forti doctor # config, credentials, TLS, auth, FortiOS version3forti get firewall/policy --fields policyid,name,action,status4forti plan set firewall/address LAN comment="office LAN"5forti apply 20261015-142233-a1b2c3 # the plan's id; needs a guarded or autonomous profileWhat you get
Catalog
Every FortiOS 7.4.8 resource
360 tables, 127 singletons and 47 typed monitor endpoints, compiled into the binary.
forti discover searches them and shows each one's attributes, key, risk tier and supported
operations without a device. Other monitor paths are readable untyped.
Read
Narrow reads
FortiOS filters, field selection and paging, checked against the catalog before anything is sent.
Device secrets (ENC ... values, passwords, keys) are redacted by default.
Change
Changes as plans
A plan reads the device, validates every operation against the SDK types, and stores the
before-state, a field diff, the exact request body and a risk tier. Planning never changes the
device. forti apply runs a plan once, checks it for drift first, verifies every change by
re-reading it, and writes a rollback plan and an audit record.
Policy
Operating modes
Profiles are read-only by default. guarded profiles apply a plan only after a person approves
it; autonomous profiles apply without approval, with every safeguard still on.
Security
Credentials kept out of sight
The API key is never an argument. It lives in the macOS Keychain or a 0600 file bound to its device, or is referenced as an environment variable or a command. TLS verification is always on.
Integrations
Scripts and AI clients
Every command takes --json for one stable envelope, and the exit status follows the error code.
forti install mcp registers forti-mcp with Claude Code and Codex, and can install an agent skill
alongside it.
Where to go next
Get started
Installation
APT, Homebrew or a source build, and a first check that it works.
Quick start
Configure a profile, check it, read the device, plan a first change and connect an AI client.
Guides
Profiles and credentials
Device profiles, where the API key comes from, TLS, and forti doctor.
Discovering and reading
Resources, discover, get, filters, fields, paging and secret redaction.
Planning and applying changes
Stored plans, operating modes, approvals, apply, rollback plans, backups and risk tiers.
AI agent integration
Register forti-mcp with Claude Code and Codex, install the agent skill, repair or remove it.
Reference
Command reference
Every command and option, the output formats and the JSON envelope.
Configuration files
Directories, file modes, config.json keys and environment variables.
Exit codes
The stable error codes and the exit status each one maps to.
Security notes
What is stored where, redaction, TLS, and what modes do and do not stop.
Development
Building
Build options, the forti-api SDK, engine shards and the release profile.
Testing
Unit tests, the mock FortiOS integration suite, and CI.