# vespo92/OPNSenseMCP [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/vespo92/OPNSenseMCP  
**GitHub Stars:** 83  
**npm Downloads (last month):** 602  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/vespo92-opnsensemcp

## Description
MCP Server for managing & interacting with Open Source NGFW OPNSense via Natural Language

## Tools
Capabilities this server exposes over MCP:

- **firewall_list_rules** — List all firewall rules
- **firewall_create_rule** — Create a new rule
- **firewall_update_rule** — Update existing rule
- **firewall_delete_rule** — Delete a rule
- **firewall_apply_changes** — Apply pending changes
- **nat_list_outbound** — List outbound NAT rules
- **nat_set_mode** — Set NAT mode
- **nat_create_outbound_rule** — Create NAT rule
- **nat_fix_dmz** — Fix DMZ NAT issues
- **nat_analyze_config** — Analyze NAT configuration
- **arp_list** — List ARP table entries
- **routing_diagnostics** — Diagnose routing issues
- **routing_fix_all** — Auto-fix routing problems
- **interface_list** — List network interfaces
- **vlan_create** — Create VLAN
- **system_execute_command** — Execute CLI command
- **backup_create** — Create configuration backup
- **service_restart** — Restart a service

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "opnsensemcp": {
    "command": "npx",
    "args": ["-y","opnsense-mcp-server"],
    "env": {
      "OPNSENSE_HOST": "",
      "OPNSENSE_API_KEY": "",
      "OPNSENSE_API_SECRET": "",
      "OPNSENSE_VERIFY_SSL": ""
    }
  }
}
```

**Requires environment variables:** `OPNSENSE_HOST`, `OPNSENSE_API_KEY`, `OPNSENSE_API_SECRET`, `OPNSENSE_VERIFY_SSL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What vespo92/OPNSenseMCP does

vespo92/OPNSenseMCP MCP server gives an MCP-compatible assistant tools for administering an OPNsense firewall. Its listed operations cover firewall rules, outbound NAT, network inspection, routing troubleshooting, VLAN creation, configuration backups, service restarts, and direct command execution.

Firewall tools support listing, creating, updating, deleting, and applying changes to rules. NAT tools can inspect outbound rules, change the NAT mode, create rules, analyze the configuration, and address documented DMZ NAT issues. Network-oriented tools expose ARP entries and interfaces, diagnose routing, attempt routing fixes, and create VLANs.

The server also includes `system_execute_command`, which can run a CLI command on OPNsense, and `backup_create` for configuration backups. These capabilities mean the connected assistant can both inspect state and make administrative changes, so access should be limited to an appropriately privileged OPNsense account.

## How it works

The primary connection uses the OPNsense API. The server reads the firewall address, API key, API secret, and SSL verification setting from environment variables. SSH is an optional second connection method. The README identifies SSH as necessary for NAT management and for advanced features that depend on shell or configuration-file access.

MCP clients invoke individual tools with structured arguments. For example, a client can request a firewall rule listing, pass network details to routing diagnostics, or provide source, destination, protocol, and port values when creating a rule. Changes that remain pending can be applied through the dedicated firewall tool.

## Setup and configuration

The project supports Node.js 18 or newer and Bun 1.0 or newer. The published npm package is `opnsense-mcp-server`; the README shows installation with `npm install -g opnsense-mcp-server`, followed by the `opnsense-mcp-server` executable. The repository can also be cloned and run with Bun or built from source with npm.

Set these required variables before starting the server:

- `OPNSENSE_HOST`: OPNsense URL and port.
- `OPNSENSE_API_KEY`: OPNsense API key.
- `OPNSENSE_API_SECRET`: OPNsense API secret.
- `OPNSENSE_VERIFY_SSL`: Whether SSL certificate verification is enabled.

For SSH-dependent functions, configure the SSH host, username, and either a password or key path. SSH must be enabled on OPNsense, and the account needs sufficient privileges. The README recommends OPNsense 24.7 or later.

Claude Desktop can launch the npm package through an MCP server entry and pass the OPNsense variables in its `env` object. The documentation also shows a Bun-based Claude Desktop configuration, but its paths are examples that must be replaced for a local checkout.

## Tools and capabilities

The listed MCP tools include:

- `firewall_list_rules`, `firewall_create_rule`, `firewall_update_rule`, `firewall_delete_rule`, and `firewall_apply_changes`
- `nat_list_outbound`, `nat_set_mode`, `nat_create_outbound_rule`, `nat_fix_dmz`, and `nat_analyze_config`
- `arp_list`, `routing_diagnostics`, `routing_fix_all`, `interface_list`, and `vlan_create`
- `system_execute_command`, `backup_create`, and `service_restart`

## Limitations and notes

API authentication failures can result from incorrect credentials, disabled API access, or firewall rules that block access. NAT functionality requires SSH configuration. CLI execution and automatic fixes should be tested against the target firewall’s permissions and operational requirements before being used in an unattended workflow. The repository is licensed under MIT.

## Getting started with this vespo92/OPNSenseMCP MCP server
Always refer to the official documentation for the most accurate and up-to-date information.

_Full upstream README: https://allmcps.com/mcp/vespo92-opnsensemcp/readme_