Enterprise DLP MCP Server
Use your own AI agent to investigate incidents and manage Enterprise DLP
through a locally run MCP server.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Managed by Panorama or Strata Cloud Manager)
- Prisma Access (Managed by Panorama or Strata Cloud Manager)
- SaaS Security Inline
- Data Security
- Prisma AIRS
Prisma Browser - Email DLP
- Endpoint DLP
|
|
|
Use the MCP server to view your Enterprise DLP
configurations and data regardless of the enforcement point
where they are applied.
|
The
Enterprise Data Loss Prevention (E-DLP) Model Context Protocol (MCP) server connects the AI agent
you already use to your
Enterprise DLP tenant. You can query incidents, manage data
patterns and data profiles, and automate
Enterprise DLP workflows in natural
language without working in
Strata Cloud Manager for each task. The MCP server runs on
your machine, calls the same
Enterprise DLP and
Email
DLP APIs that your own automation uses, and honors the role of the service
account it authenticates with, so it can never do more than that account allows. The MCP
server complements
Strata Cloud Manager and doesn't replace it.
Use the MCP server when you manage configuration at scale, investigate incidents through
automation or third-party tools rather than the console, or want an agent to complete
multi-step work, such as triaging incidents, investigating false positives, or building
a data profile for a compliance standard, from a single request. You choose the AI agent
and the AI model, so you control where the data your agent reads is processed. You
continue to use Strata Cloud Manager to review and verify any result, and to manage the
settings that the public APIs don't expose.
Components
The integration has components that you provide and components that Palo Alto Networks provides:
AI Agent—The software that runs your AI conversations and issues
commands on your behalf. The MCP server supports any MCP-compatible AI agent. The procedures in this guide cover
the most popular agents:
Claude Desktop
Claude Code
OpenAI Codex
Cursor
VS Code with Copilot
AI Model—The large language model that powers the agent's reasoning.
The MCP server supports any frontier model that supports MCP. You choose the
model and pay for the tokens it uses. Palo Alto Networks
never sees your model API keys.
MCP Server—A local process that translates your agent's requests into
Enterprise DLP API calls. The server runs from the public
@paloaltonetworks/mcp-dlp npm package using
npx, so you do not download or install a
separate application.
Skills—Prebuilt workflows that
Palo Alto Networks authors and tests,
such as auditing your data patterns or recommending coverage for unprotected
data. Your agent runs a skill from a prompt, so you do not write any code. The
Enterprise DLP MCP Server Skills topic describes each skill.
Service Account—The identity that the MCP server uses to authenticate
to your tenant with a Client ID and Client Secret. Create a dedicated
service account for your agent rather than reusing an administrator
account.
Role—The permissions assigned to the service account. You can assign a
predefined role or create a custom role, and the agent can never exceed what
the role allows.
Access level—A setting you choose when you set up the MCP server. With
read-only access, you can view incidents, data profiles, data patterns, and
reports, and the MCP server does not make write or delete operations
available to your agent, even if the service account has broader
permissions. With read-write access, your agent can also create, update, and
delete Enterprise DLP configuration and incidents.
Enterprise DLP APIs and Tenant—The public APIs that the MCP server
calls, and the tenant that stores your data patterns, data profiles,
policies, and incidents. The MCP server changes how you reach Enterprise DLP, not how Enterprise DLP detects and enforces
policy.
Data Flow and Visibility
Your AI agent and the MCP server run on your machine. The MCP server sends API calls
directly from your environment to the Palo Alto Networks API gateway, so Palo Alto Networks sees which API call your agent made, when it made it, whether it
succeeded, and any error code returned. Palo Alto Networks does not see your
conversations, your prompts, your model's responses, or your model token costs.
The AI model you choose processes the incident details and snippets that the MCP server returns to your agent. Choose a model that meets your data
handling requirements, and start with read-only access until you are confident
in how your agent behaves.
MCP Server Hosting and Security
Palo Alto Networks publishes the MCP server as the public
@paloaltonetworks/mcp-dlp package on the
npm registry, under the
@paloaltonetworks scope. When your agent starts the
server through
npx, npm downloads the package from that
registry to your machine, and the server runs there as a local process. If you
prefer not to use npm, you can download a standalone binary from the
MCP
Server page in
Strata Cloud Manager. The binary doesn't require
Node.js.
The MCP server is built to limit what it can do and to protect your credentials:
Local process—The MCP server runs on your machine and connects
directly to the Enterprise DLP API. It doesn't route your data through
an intermediary service.
Local credentials—Your service account credentials stay on your
machine, in your agent's configuration or your environment. The server uses
them to request short-lived OAuth access tokens and refreshes the tokens
automatically.
Least privilege—API access follows the role of your service account,
and the server is read-only by default. In read-only mode, the server
doesn't register write or delete tools, so your agent can't discover or call
them.
Protected access token—The server holds its access token in memory. To
prevent a malicious configuration or process from reading that token, the
server refuses to start if it detects debugger-inspection settings in its
environment.
Verifiable releases—Each release publishes a software bill of
materials (SBOM) in CycloneDX format, SHA-256 checksums, and a provenance
file that you can use to verify the release artifacts.
What You Can and Cannot Manage
The MCP server uses the public
Enterprise DLP
APIs, so
you can manage only the settings and data that those APIs expose. You can manage
data patterns, data dictionaries, document types, data profiles, data filtering
profiles, endpoint DLP policies and peripherals, and incidents, and you can view
reports. You continue to configure some settings in
Strata Cloud Manager, including
granular data profile rules, evidence storage connections, syslog and ICAP
forwarding, incident automation rules, end user coaching templates, and the push of
endpoint DLP configuration.
