Log inSubmit server
OPNSenseMCP logo

OPNSenseMCP

by vespo92

Manage OPNsense firewall rules, NAT, routing, interfaces, VLANs, backups, and services through MCP tools.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install OPNSenseMCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "vespo92-opnsensemcp": {
      "command": "npx",
      "args": [
        "-y",
        "opnsense-mcp-server"
      ],
      "env": {
        "OPNSENSE_HOST": "YOUR_VALUE_HERE",
        "OPNSENSE_API_KEY": "YOUR_VALUE_HERE",
        "OPNSENSE_API_SECRET": "YOUR_VALUE_HERE",
        "OPNSENSE_VERIFY_SSL": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y opnsense-mcp-server

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 24d ago.

Overview

vespo92/OPNSenseMCP MCP server connects AI assistants to an OPNsense firewall through its API, with optional SSH access for advanced operations. It exposes tools for firewall rule CRUD, outbound NAT management, routing diagnostics, ARP inspection, VLAN creation, CLI commands, backups, and service restarts. Reach for it when an agent needs to inspect or change OPNsense configuration using natural-language requests. OPNsense API credentials are required, while SSH credentials are needed for NAT and other SSH-based features.

Use cases

  • Create and update OPNsense firewall rules
  • Diagnose and fix routing problems
  • Analyze and modify outbound NAT configuration
  • Inspect ARP entries and network interfaces
  • Create backups or restart OPNsense services

Key features

  • Firewall rule CRUD and change application
  • Outbound NAT management and analysis
  • Routing diagnostics and automatic fixes
  • ARP, interface, and VLAN operations
  • OPNsense CLI command execution over SSH
  • Configuration backups and service restarts

Tools18

What OPNSenseMCP lets your agent do. Expand a tool for its parameters.

Self-reported~164 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

17/18 checks healthy over the last 79d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 7d ago via OSV.dev · opnsense-mcp-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars94Stargazers on the source repository.
npm downloads586Package downloads in the last 30 days.
Last commit1mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed18Callable tools this server registers over MCP.
Directory activity6 viewsConfig copies, upvotes, and views on AllMCPs.

How OPNSenseMCP works

What vespo92/OPNSenseMCP does

vespo92/OPNSenseMCP MCP server gives an MCP-compatible assistant tools for administering an OPNsense firewall. Its listed operations cover firewall rules, outbound NAT, network inspection, routing troubleshooting, VLAN creation, configuration backups, service restarts, and direct command execution.

Firewall tools support listing, creating, updating, deleting, and applying changes to rules. NAT tools can inspect outbound rules, change the NAT mode, create rules, analyze the configuration, and address documented DMZ NAT issues. Network-oriented tools expose ARP entries and interfaces, diagnose routing, attempt routing fixes, and create VLANs.

The server also includes system_execute_command, which can run a CLI command on OPNsense, and backup_create for configuration backups. These capabilities mean the connected assistant can both inspect state and make administrative changes, so access should be limited to an appropriately privileged OPNsense account.

How it works

The primary connection uses the OPNsense API. The server reads the firewall address, API key, API secret, and SSL verification setting from environment variables. SSH is an optional second connection method. The README identifies SSH as necessary for NAT management and for advanced features that depend on shell or configuration-file access.

MCP clients invoke individual tools with structured arguments. For example, a client can request a firewall rule listing, pass network details to routing diagnostics, or provide source, destination, protocol, and port values when creating a rule. Changes that remain pending can be applied through the dedicated firewall tool.

Setup and configuration

The project supports Node.js 18 or newer and Bun 1.0 or newer. The repository can also be cloned and run with Bun or built from source with npm.

Set these required variables before starting the server:

  • OPNSENSE_HOST: OPNsense URL and port.
  • OPNSENSE_API_KEY: OPNsense API key.
  • OPNSENSE_API_SECRET: OPNsense API secret.
  • OPNSENSE_VERIFY_SSL: Whether SSL certificate verification is enabled.

For SSH-dependent functions, configure the SSH host, username, and either a password or key path. SSH must be enabled on OPNsense, and the account needs sufficient privileges. The README recommends OPNsense 24.7 or later.

Claude Desktop can launch the npm package through an MCP server entry and pass the OPNsense variables in its env object. The documentation also shows a Bun-based Claude Desktop configuration, but its paths are examples that must be replaced for a local checkout.

Tools and capabilities

The listed MCP tools include:

  • firewall_list_rules, firewall_create_rule, firewall_update_rule, firewall_delete_rule, and firewall_apply_changes
  • nat_list_outbound, nat_set_mode, nat_create_outbound_rule, nat_fix_dmz, and nat_analyze_config
  • arp_list, routing_diagnostics, routing_fix_all, interface_list, and vlan_create
  • system_execute_command, backup_create, and service_restart

Limitations and notes

API authentication failures can result from incorrect credentials, disabled API access, or firewall rules that block access. NAT functionality requires SSH configuration. CLI execution and automatic fixes should be tested against the target firewall’s permissions and operational requirements before being used in an unattended workflow. The repository is licensed under MIT.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about OPNSenseMCP

Install the npm package with `npm install -g opnsense-mcp-server`, then start it with the `opnsense-mcp-server` command.

Set `OPNSENSE_HOST`, `OPNSENSE_API_KEY`, `OPNSENSE_API_SECRET`, and `OPNSENSE_VERIFY_SSL`. SSH variables are optional for advanced features.

Yes. The README provides Claude Desktop configurations using either the npm package or Bun.

SSH is optional for the basic setup but required for NAT management and other advanced SSH-based features.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewOPNSenseMCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/vespo92-opnsensemcp?style=directory)](https://allmcps.com/mcp/vespo92-opnsensemcp)
HTML Embed
<a href="https://allmcps.com/mcp/vespo92-opnsensemcp"><img src="https://allmcps.com/api/badge/vespo92-opnsensemcp?style=directory" alt="OPNSenseMCP on AllMCPs" /></a>