Model Context Protocol server for OPNSense firewall management with inter-VLAN routing diagnostics, ARP table, DNS filtering and HAProxy support via
Model Context Protocol server for OPNSense firewall management with inter-VLAN routing diagnostics, ARP table, DNS filtering and HAProxy support via Claude Desktop. Exposed over MCP by the opnsensemcp mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
A Model Context Protocol (MCP) server for comprehensive OPNsense firewall management. This server enables AI assistants like Claude to directly manage firewall configurations, diagnose network issues, and automate complex networking tasks.
tsx on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
Everything the assistant can do here goes through one of these:
firewall_list_rules — List all firewall rulesfirewall_create_rule — Create a new rulefirewall_update_rule — Update existing rulefirewall_delete_rule — Delete a rulefirewall_apply_changes — Apply pending changesnat_list_outbound — List outbound NAT rulesnat_set_mode — Set NAT modenat_create_outbound_rule — Create NAT rulenat_fix_dmz — Fix DMZ NAT issuesnat_analyze_config — Analyze NAT configurationarp_list — List ARP table entriesrouting_diagnostics — Diagnose routing issuesYou will need 6 environment variables: OPNSENSE_HOST, OPNSENSE_API_KEY, OPNSENSE_API_SECRET, OPNSENSE_VERIFY_SSL, OPNSENSE_SSH_HOST, OPNSENSE_SSH_KEY_PATH. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. OPNSenseMCP's toolset — firewall_list_rules, firewall_create_rule, firewall_update_rule and 11 more — is a fair guide to whether it matches your workflow. It is maintained by vespo92; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| firewall_list_rules | List all firewall rules |
| firewall_create_rule | Create a new rule |
| firewall_update_rule | Update existing rule |
| firewall_delete_rule | Delete a rule |
| firewall_apply_changes | Apply pending changes |
| nat_list_outbound | List outbound NAT rules |
| nat_set_mode | Set NAT mode |
| nat_create_outbound_rule | Create NAT rule |
| nat_fix_dmz | Fix DMZ NAT issues |
| nat_analyze_config | Analyze NAT configuration |
| arp_list | List ARP table entries |
| routing_diagnostics | Diagnose routing issues |
| routing_fix_all | Auto-fix routing problems |
| interface_list | List network interfaces |
### Using Bun with Claude Desktop
```json
{
"mcpServers": {
"opnsense": {
"command": "bun",
"args": ["run", "/path/to/OPNSenseMCP/src/index.ts"],
"env": {
"OPNSENSE_HOST": "https://your-opnsense:port",
"OPNSENSE_API_KEY": "your-key",
"OPNSENSE_API_SECRET": "your-secret",
"OPNSENSE_VERIFY_SSL": "false"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| OPNSENSE_HOST | Endpoint or connection string the server talks to. | Optional |
| OPNSENSE_API_KEY | Credential the server authenticates with. | Yes |
| OPNSENSE_API_SECRET | Credential the server authenticates with. | Yes |
| OPNSENSE_VERIFY_SSL | Configuration value read at startup. | Optional |
| OPNSENSE_SSH_HOST | Endpoint or connection string the server talks to. | Optional |
| OPNSENSE_SSH_KEY_PATH | Credential the server authenticates with. | Yes |
Read-only SQL access to Postgres — let your assistant inspect schemas and answer questions from real data.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.
Serverless Postgres with database branching — point your assistant at Neon and let it work on disposable copies.