OPNSenseMCP

What vespo92/OPNSenseMCP does

vespo92/OPNSenseMCP MCP server gives an MCP-compatible assistant tools for administering an OPNsense firewall. Its listed operations cover firewall rules, outbound NAT, network inspection, routing troubleshooting, VLAN creation, configuration backups, service restarts, and direct command execution.

Firewall tools support listing, creating, updating, deleting, and applying changes to rules. NAT tools can inspect outbound rules, change the NAT mode, create rules, analyze the configuration, and address documented DMZ NAT issues. Network-oriented tools expose ARP entries and interfaces, diagnose routing, attempt routing fixes, and create VLANs.

The server also includes system_execute_command, which can run a CLI command on OPNsense, and backup_create for configuration backups. These capabilities mean the connected assistant can both inspect state and make administrative changes, so access should be limited to an appropriately privileged OPNsense account.

How it works

The primary connection uses the OPNsense API. The server reads the firewall address, API key, API secret, and SSL verification setting from environment variables. SSH is an optional second connection method. The README identifies SSH as necessary for NAT management and for advanced features that depend on shell or configuration-file access.

MCP clients invoke individual tools with structured arguments. For example, a client can request a firewall rule listing, pass network details to routing diagnostics, or provide source, destination, protocol, and port values when creating a rule. Changes that remain pending can be applied through the dedicated firewall tool.

Setup and configuration

The project supports Node.js 18 or newer and Bun 1.0 or newer. The published npm package is opnsense-mcp-server; the README shows installation with npm install -g opnsense-mcp-server, followed by the opnsense-mcp-server executable. The repository can also be cloned and run with Bun or built from source with npm.

Set these required variables before starting the server:

• OPNSENSE_HOST: OPNsense URL and port.
• OPNSENSE_API_KEY: OPNsense API key.
• OPNSENSE_API_SECRET: OPNsense API secret.
• OPNSENSE_VERIFY_SSL: Whether SSL certificate verification is enabled.

For SSH-dependent functions, configure the SSH host, username, and either a password or key path. SSH must be enabled on OPNsense, and the account needs sufficient privileges. The README recommends OPNsense 24.7 or later.

Claude Desktop can launch the npm package through an MCP server entry and pass the OPNsense variables in its env object. The documentation also shows a Bun-based Claude Desktop configuration, but its paths are examples that must be replaced for a local checkout.

Tools and capabilities

The listed MCP tools include:

• firewall_list_rules, firewall_create_rule, firewall_update_rule, firewall_delete_rule, and firewall_apply_changes
• nat_list_outbound, nat_set_mode, nat_create_outbound_rule, nat_fix_dmz, and nat_analyze_config
• arp_list, routing_diagnostics, routing_fix_all, interface_list, and vlan_create
• system_execute_command, backup_create, and service_restart

Limitations and notes

API authentication failures can result from incorrect credentials, disabled API access, or firewall rules that block access. NAT functionality requires SSH configuration. CLI execution and automatic fixes should be tested against the target firewall’s permissions and operational requirements before being used in an unattended workflow. The repository is licensed under MIT.

Getting started with this vespo92/OPNSenseMCP MCP server

Always refer to the official documentation for the most accurate and up-to-date information.