Installation

forti-mcp is a single executable, forti-mcp. libcurl is its only runtime dependency. Install it from the ValkyrianLabs APT repository, from Homebrew, or build it from source, then check the version it reports.

Install

1sudo install -d -m 0755 /etc/apt/keyrings2sudo curl -fsSL https://apt.valkyrianlabs.com/pubkey.gpg \3  -o /etc/apt/keyrings/valkyrianlabs.gpg4sudo chmod 0644 /etc/apt/keyrings/valkyrianlabs.gpg5 6echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/valkyrianlabs.gpg] https://apt.valkyrianlabs.com stable main" | \7  sudo tee /etc/apt/sources.list.d/valkyrianlabs.list > /dev/null8 9sudo apt update10sudo apt install -y forti-mcp11sudo apt install -y forti-cli      # the forti CLI: the forti home, profiles, approvals, workspace

1brew install valkyrianlabs/tap/forti-mcp2brew install valkyrianlabs/tap/forti-cli      # the forti CLI

1# Ubuntu: sudo apt install meson ninja-build g++ pkgconf libcurl4-openssl-dev2# macOS:  brew install meson ninja       (libcurl comes with the SDK)3meson setup build4meson compile -C build -j 45meson install -C build --skip-subprojects

Check the installation

1forti-mcp --version

1forti-mcp 0.2.0 (engine forti-cli 6a19035, forti-api 1.0.1)

The version line names what the binary was built from: the forti-cli engine revision and the forti-api version. A build from a modified engine checkout shows the revision with -dirty.

The forti home

forti-mcp keeps nothing of its own. It reads the forti home that the forti CLI manages: ~/.forti, or the directory $FORTI_HOME names. forti configure creates it (mode 0700) with the first device profile, and forti home shows every location in it:

1$ forti home2forti home: ~/.forti3  config       ~/.forti/config.json4  credentials  ~/.forti/credentials/  file store5  state        ~/.forti/state/  plans, approvals, audit log, backups6  cache        ~/.forti/cache/7  certs        ~/.forti/certs/  forti cert create8  secrets      macOS Keychain (service "forti")

The home is also where you start your AI agent: forti install mcp --scope workspace registers forti-mcp there and nowhere else (Connecting AI clients). Command line lists the variables that move single locations.

Upgrading from 0.1

Releases before 0.2 kept the configuration in ~/.config/forti, the state in ~/.local/state/forti and the cache in ~/.cache/forti (or under the XDG_* variables). While ~/.forti/config.json does not exist, that older configuration does and FORTI_HOME is not set, forti and forti-mcp keep using the old locations, so an existing setup works unchanged. Move it into the home with:

1forti home migrate

It moves config.json, credentials/, the state and the cache, keeping their modes, never overwrites a config.json already in the home, and is harmless to run again. Keychain items need no change. forti home and forti doctor point out a setup that has not been migrated.

Next