Modular MCP server for OPNsense firewall management - 88 tools providing access to 2000+ methods
Opnsense becomes available to MCP clients through the opnsense mcp server. Modular MCP server for OPNsense firewall management - 88 tools providing access to 2000+ methods.
A modular Model Context Protocol (MCP) server that provides 88 module-based tools giving access to over 2000 OPNsense firewall management methods through a type-safe TypeScript interface.
Once connected, the assistant can call these 14 tools directly:
Built — in error handling and retriescore_manage — Core system functionsfirewall_manage — Firewall rules & aliasesinterfaces_manage — Network interfacesdiagnostics_manage — System diagnosticsauth_manage — Authenticationfirmware_manage — Firmware updatesopenvpn_manage — OpenVPNipsec_manage — IPsec VPNwireguard_manage — WireGuard VPNunbound_manage — DNS resolverdhcpv4_manage — DHCP serverplugin_nginx_manage — Nginx web serverplugin_haproxy_manage — HAProxy load balancerThe server is distributed via npm as @richard-stovall/opnsense-mcp-server, so most clients can run it without a manual build step. Add it to your MCP client's configuration and restart the client to pick it up — the copy-paste configs for Claude Desktop, Claude Code and Cursor are on this page.
Before the server will start you need to supply 5 environment variables: OPNSENSE_URL, OPNSENSE_API_KEY, OPNSENSE_API_SECRET, OPNSENSE_VERIFY_SSL, INCLUDE_PLUGINS. Keep credentials in your client's env block or a secrets manager rather than committing them.
Developer-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. Opnsense sits in that group, and the shape of its toolset — Built, core_manage, firewall_manage among others — tells you what it is really for. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.
| Tool | What it does |
|---|---|
| Built | in error handling and retries |
| core_manage | Core system functions |
| firewall_manage | Firewall rules & aliases |
| interfaces_manage | Network interfaces |
| diagnostics_manage | System diagnostics |
| auth_manage | Authentication |
| firmware_manage | Firmware updates |
| openvpn_manage | OpenVPN |
| ipsec_manage | IPsec VPN |
| wireguard_manage | WireGuard VPN |
| unbound_manage | DNS resolver |
| dhcpv4_manage | DHCP server |
| plugin_nginx_manage | Nginx web server |
| plugin_haproxy_manage | HAProxy load balancer |
{
"mcpServers": {
"opnsense": {
"command": "npx",
"args": ["-y", "@richard-stovall/opnsense-mcp-server"],
"env": {
"OPNSENSE_URL": "https://192.168.1.1",
"OPNSENSE_API_KEY": "your-api-key",
"OPNSENSE_API_SECRET": "your-api-secret",
"OPNSENSE_VERIFY_SSL": "false"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| OPNSENSE_URL | Endpoint or connection string the server talks to. | Yes |
| OPNSENSE_API_KEY | Credential the server authenticates with. | Yes |
| OPNSENSE_API_SECRET | Credential the server authenticates with. | Yes |
| OPNSENSE_VERIFY_SSL | Configuration value read at startup. | Optional |
| INCLUDE_PLUGINS | Configuration value read at startup. | Optional |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.