OPNsense MCP Server

81 toolsacross 10 domains: system, firewall, network, DNS, DHCP, VPN, HAProxy, services, diagnostics, and security.

- Python 3.11+
- OPNsense 24.7 or newer— the MCP server relies on the MVC-based API endpoints introduced in OPNsense 24.7. Older versions use a different API structure that is not compatible. The server auto-detects the OPNsense version on first connect and selects the correct endpoint naming (camelCase for pre-25.7, snake_case for 25.7+). OPNsense 26.x is fully supported, including its changed firmware status response format.

This MCP server is designed with security as the primary concern:

- Read-only by default— write operations require explicit opt-in viaOPNSENSE_ALLOW_WRITES=true
- Savepoint/rollback (OPNsense < 26.7 only)— where OPNsense still offers the savepoint API, firewall modifications use its built-in 60-second auto-revert; changes must be explicitly confirmed or they roll back automatically. OPNsense 26.7 removed that API upstream — the server detects the missing endpoint at runtime and applies firewall changes immediately, with no automatic rollback
- Endpoint blocklist— dangerous endpoints (halt,reboot,poweroff,firmware update/upgrade) are hard-blocked at the API client level and can never be called
- API-only— no SSH access, no command execution, no direct config file manipulation
- Local transport— STDIO only, no network-exposed HTTP/SSE endpoints
- No credential exposure— API keys are never included in tool output, logs, or error messages
- Input validation— hostname parameters are validated against shell metacharacter injection
- Sensitive data stripping— config backup strips passwords and keys by default
- Log in to your OPNsense web interface
- Go toSystem > Access > Users
- Either edit an existing user or create a dedicated API user:

- For production use, create a dedicated user (e.g.,mcp-api) with only the privileges needed
- For read-only access, assign the user to a group with read-only API access

Tip:For a read-only setup (recommended for getting started), you don't need to change any permissions — the default API access is sufficient for all read-only tools.

# Using pip pip install opnsense-mcp-server # Using uv (recommended for isolated environments) uv pip install opnsense-mcp-server # Using Docker docker pull uhlenheide/opnsense-mcp-server # From source git clone https://github.com/lucamarien/opnsense-mcp-server cd opnsense-mcp-server pip install -e .

{ "mcpServers": { "opnsense": { "command": "opnsense-mcp", "env": { "OPNSENSE_URL": "https://192.168.1.1/api", "OPNSENSE_API_KEY": "your-api-key-here", "OPNSENSE_API_SECRET": "your-api-secret-here", "OPNSENSE_VERIFY_SSL": "false", "OPNSENSE_ALLOW_WRITES": "false" } } } }

Full configuration management for the HAProxy load balancer (requires os-haproxy plugin).

Note:HAProxy changes do NOT use savepoint protection — they apply immediately on reconfigure. Always callopn_haproxy_configtestbeforeopn_reconfigure_haproxy.

Write operations requireOPNSENSE_ALLOW_WRITES=true. OnOPNsense < 26.7, firewall changes additionally go through OPNsense's savepoint mechanism:
- Before any firewall change, a savepoint is created automatically
- The change is applied(rule toggle, add, or delete)
- A 60-second countdown starts— if not confirmed, OPNsense automatically reverts the change
- Useopn_confirm_changeswith the returnedrevisionto make changes permanent

On those versions, if an AI assistant makes a bad firewall change that locks you out, the change reverts automatically within 60 seconds.

OPNsense 26.7 removed the savepoint/rollback API upstream, so there is no auto-revert on 26.7+.The server does not hardcode a version cut-off: it probes for the savepoint endpoint on the first firewall write and, if OPNsense answers that the endpoint does not exist, degrades to direct apply for the rest of the session. Checkopn_mcp_info— itssavepoint_supportfield reportstrue,false, ornullif no write has probed yet. Write tools then return an emptyrevision,opn_confirm_changesanswers withstatus: "not_applicable", and every firewall change is immediate and permanent.

Warning:On OPNsense 26.7+ take a config backup (opn_download_config, or System > Configuration > Backups) before enabling writes, and keep out-of-band access to the box — a rule that locks you out will not revert itself.

Note:opn_reconfigure_unbound,opn_reconfigure_haproxy,opn_reconfigure_ddclient,opn_reconfigure_dnsmasq, andopn_configure_mdns_repeaterrequire writes but don't use savepoints — they apply service configuration changes and are not automatically revertible.

These guides show real-world MCP tool usage patterns and explain the security considerations behind each approach.

Chia Health MCP Server — Patient workflow integration for a licensed US telehealth platform. Browse GLP-1 medications (semaglutide, tirzepatide), peptide therapies (sermorelin, NAD+, glutathione), and longevity treatments. Check eligibility, complete intake, sign consents, and manage treatment plans. 30 tools, HIPAA-compliant. All prescriptions evaluated by licensed US healthcare providers and delivered from FDA-regulated pharmacies across 50 states + DC.

Broker + MCP server for last-bidder-wins games on Solana — agents register, auto-fund a Privy wallet, and bid via streamable HTTP

AI-powered no-code app builder with 17 MCP tools — create projects, generate pages from natural language, AI text/image generation (GPT, Claude, Gemini, 14+ models), page CRUD, workflow execution, publish & version control. SSE transport, API key auth.

An mcp server for your food ordering needs.

Agent-to-Agent handoff certification for multi-agent systems — validates context preservation, verifies agent capabilities before handoff, logs transfer chains, and ensures no data loss in agent orchestration.

Unified MCP & skill management gateway with progressive disclosure. Manages multiple MCP servers as Agent Apps, loading tool schemas on demand for 99% context token savings. Shared across Claude Code, Codex, OpenCode and more.

A collection of Model Context Protocol (MCP) servers for various tasks and integrations, supporting both Python and Node.js environments.

Open-souSecurely feeds real security refreshed rules into Cursor, Claude Code, and Windsurf — zero config, no API key.

Health intelligence MCP — access biomarkers, biological age, and personalized longevity action plans from your Aniva profile.