PanOS agent skills for Claude Code, Cursor and RevampKey

4 ready-made playbooks that teach an AI agent how to do real PanOS work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect PanOS

Connect PanOS once and all 4 skills install themselves and stay up to date. Mac, Windows and Linux.

All 4 PanOS skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereAsks before writing24 PanOS tools

Use the PanOS MCP connector safely

Teaches the agent how to work with a PAN-OS firewall through the PanOS MCP connector: confirm the device, pick the right read tool, keep reads small, and ask before any static route change.

Use it when

You want an assistant to read a PAN-OS firewall's state without touching it
You need to confirm which firewall an assistant is talking to before a check
You want static route changes to wait for your approval

Tools it uses

get_firewall_info
get_ha_status
get_system_resources
get_active_sessions
get_interfaces
get_zones
get_vlans
get_arp_table
get_dhcp_leases
get_dns_proxy
get_routing_table
get_static_routes
get_security_rules
get_security_profiles
get_security_profile_groups
get_pbf_rules
get_dos_profiles
get_qos_rules
get_address_objects
get_address_groups
get_service_objects
get_service_groups
add_static_route
delete_static_route

Example

Check the PAN-OS firewall at the Lyon site and tell me what the routing table looks like for the 10.20.0.0/16 range.

The connector reaches fw-lyon-01, a PA-850 on PAN-OS 10.2.4, which I confirmed first. The routing table holds 212 entries; 9 of them cover 10.20.0.0/16. I read only the routing table and did not change anything. Two static routes match that range, and both are still listed as active.

Use in RevampKeyRead the full skill →

Read-only8 PanOS tools

Check a PAN-OS firewall's health with AI

Triages one PAN-OS firewall's HA state, resources, interfaces and session load, then gives a healthy, degraded or escalate verdict. It stays read-only and asks before any change.

Use it when

Checking whether a firewall is healthy after a maintenance window
Investigating a slow or unstable PAN-OS device
Confirming HA is in sync before a planned change

Tools it uses

get_ha_status
get_system_resources
get_interfaces
get_zones
get_active_sessions
get_arp_table
get_dhcp_leases
get_dns_proxy

Example

Is the edge firewall at branch-04 healthy? It feels slow since this morning.

Verdict: degraded. HA is active/passive with both peers up and in sync. CPU is steady at about 62 percent, but memory has climbed across three readings. One interface on the HA link is flapping. Sessions sit at roughly 80 percent of the device's observed load. I recommend a recheck in 30 minutes and escalation if memory keeps climbing.

Use in RevampKeyRead the full skill →

Read-only8 PanOS tools

Reconcile PAN-OS routing and zones

Checks the routing table, static routes, interfaces, zones and VLANs of one PAN-OS firewall against each other to find dead routes, unrouted subnets and zone mismatches. It reads state only and asks before changing anything.

Use it when

Traffic to a subnet is not being routed and you need to find where the path breaks
You want to check that static routes still match live interfaces after a network change
You are auditing whether every served subnet sits in the zone policy expects

Tools it uses

get_interfaces
get_zones
get_vlans
get_routing_table
get_arp_table
get_static_routes
get_dns_proxy
get_dhcp_leases

Example

Check firewall fw-edge-01 for dead static routes and subnets that have no route.

On fw-edge-01 I found 2 static routes with next hops on a down interface and one subnet, 10.20.4.0/24 on VLAN 420, with an address but no connected route. The default route is single and points out ethernet1/1. Two items need your network owner: whether the 10.20.4.0/24 link is planned and whether zone DMZ should have an interface.

Use in RevampKeyRead the full skill →

Asks before writing7 PanOS tools

Change a PAN-OS static route safely

Plans and applies one static route add or removal on a PAN-OS firewall, checking the routing table and next-hop reachability first. It shows the plan and waits for your explicit yes before writing anything.

Use it when

You need to add a route to a new branch subnet through a known next hop
You want to remove a stale static route without cutting off a prefix
You need to confirm a route change actually took effect in the routing table

Tools it uses

get_static_routes
get_routing_table
get_interfaces
get_zones
get_arp_table
add_static_route
delete_static_route

Example

Add a static route for 10.40.0.0/16 via next hop 10.1.1.254 on ethernet1/2 on fw-edge-01, and check it won't shadow anything first.

Before changing anything on fw-edge-01, I checked the routing table: 10.40.0.0/16 has no existing static route and is currently unreachable. Next hop 10.1.1.254 sits on ethernet1/2 (subnet 10.1.1.0/24), which is up, and there is an ARP entry for it. No more specific route overlaps the prefix. Here is the planned add; nothing has been written yet. Reply with your explicit yes to apply it.

Use in RevampKeyRead the full skill →

Get all 4 without copying a file

RevampKey adds the skills when you connect PanOS, updates them for you and removes them when you disconnect.

Download RevampKey

How PanOS skills work

Connect PanOS
The PanOS MCP server gives the agent its tools.
Ask in plain words
“Is the edge firewall at branch-04 healthy? It feels slow since this morning.” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install PanOS skills

In RevampKey the skills install themselves when you connect PanOS. In other tools each skill is one folder with a SKILL.md file, and you also need the PanOS MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect PanOS. All 4 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Is the edge firewall at branch-04 healthy? It feels slow since this morning.”
Download RevampKeyConnect PanOS · 1 click
Get RevampKey to connect PanOS
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and PanOS is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials firewall-health-check routing-and-zone-reconciliation static-route-change; do curl -fsSL --create-dirs -o .claude/skills/panos-mcp-$s/SKILL.md https://revampkey.com/marketplace/panos-mcp/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the PanOS MCP server in Claude Code.

Run this in your project folder to add all 4 skills:

for s in essentials firewall-health-check routing-and-zone-reconciliation static-route-change; do
  curl -fsSL --create-dirs -o .claude/skills/panos-mcp-$s/SKILL.md https://revampkey.com/marketplace/panos-mcp/skills/$s/SKILL.md
done

Ask in plain language, for example “Is the edge firewall at branch-04 healthy? It feels slow since this morning.”

Into the shared .agents/skills folder

Connect the PanOS MCP server in Cursor.

Run this in your project folder to add all 4 skills:

for s in essentials firewall-health-check routing-and-zone-reconciliation static-route-change; do
  curl -fsSL --create-dirs -o .agents/skills/panos-mcp-$s/SKILL.md https://revampkey.com/marketplace/panos-mcp/skills/$s/SKILL.md
done

Ask in plain language, for example “Is the edge firewall at branch-04 healthy? It feels slow since this morning.”

Into the shared .agents/skills folder

Connect the PanOS MCP server in Codex.

Run this in your project folder to add all 4 skills:

for s in essentials firewall-health-check routing-and-zone-reconciliation static-route-change; do
  curl -fsSL --create-dirs -o .agents/skills/panos-mcp-$s/SKILL.md https://revampkey.com/marketplace/panos-mcp/skills/$s/SKILL.md
done

Ask in plain language, for example “Is the edge firewall at branch-04 healthy? It feels slow since this morning.”

Into the shared .agents/skills folder

Connect the PanOS MCP server in VS Code.

Run this in your project folder to add all 4 skills:

for s in essentials firewall-health-check routing-and-zone-reconciliation static-route-change; do
  curl -fsSL --create-dirs -o .agents/skills/panos-mcp-$s/SKILL.md https://revampkey.com/marketplace/panos-mcp/skills/$s/SKILL.md
done

Ask in plain language, for example “Is the edge firewall at branch-04 healthy? It feels slow since this morning.”

RevampKey or copy the files?

In RevampKey

One click when you connect PanOS
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the PanOS MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

PanOS skills FAQ

What is a PanOS agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each PanOS skill describes one job, which PanOS tools to use in which order, what to check first and when to stop and ask you.

Do the PanOS skills change anything on their own?

2 of the 4 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in PanOS.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect PanOS; elsewhere you copy the folders into your project or skills directory.

Do I need the PanOS MCP server too?

Yes. The skills tell the agent how to do the work; the PanOS MCP server gives it the tools to do it. The PanOS MCP setup guide covers every client.

PanOS MCP server setup · This page as Markdown

Put PanOS’s best workflows in your agent

Download RevampKey, connect PanOS and ask your first question in about a minute.

Download RevampKey Connect PanOS · 1 click

All 4 PanOS skills

Use the PanOS MCP connector safely

Use it when

Tools it uses

Check a PAN-OS firewall's health with AI

Use it when

Tools it uses

Reconcile PAN-OS routing and zones

Use it when

Tools it uses

Change a PAN-OS static route safely

Use it when

Tools it uses

Get all 4 without copying a file

How PanOS skills work

How to install PanOS skills

RevampKey or copy the files?

In RevampKey

Copy into your project

PanOS skills FAQ

Put PanOS’s best workflows in your agent

Skills for related tools