BunkerWeb MCP
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| WORKERS | No | Docker entrypoint worker count. | 1 |
| SEARCH_MODE | No | 'remote' enables documentation search; 'disabled' omits the tool. | remote |
| CACHE_ENABLED | No | Cache selected read operations in process memory. | true |
| RATE_LIMIT_WS | No | Messages per WebSocket connection, when rate limiting is enabled. | 500/minute |
| RATE_LIMIT_RPC | No | Requests to /rpc per client IP, when rate limiting is enabled. | 100/minute |
| SEARCH_API_URL | No | URL of the remote search service API. | http://localhost:8000 |
| SEARCH_TIMEOUT | No | Search API request timeout in seconds. | 10.0 |
| RATE_LIMIT_TOOLS | No | Requests to /tools per client IP, when rate limiting is enabled. | 30/minute |
| MCP_ALLOWED_HOSTS | No | Comma-separated MCP Host allowlist. Include the port variants clients send. | localhost,127.0.0.1 |
| MCP_ENABLE_SKILLS | No | Serve bundled Agent Skills as skill://bunkerweb/ resources. | true |
| BUNKERWEB_BASE_URL | No | Base URL for the BunkerWeb control-plane API. | http://localhost:8888 |
| RATE_LIMIT_ENABLED | No | Enable rate limiting on endpoints. | false |
| BUNKERWEB_API_TOKEN | No | Static API token used for the Authorization bearer header. | |
| BUNKERWEB_LOGS_PATH | No | Runtime log directory; unset disables log tools. | |
| BUNKERWEB_LOG_LEVEL | No | Application log level. | INFO |
| MCP_ALLOWED_ORIGINS | No | Comma-separated MCP Origin allowlist for browser clients. | |
| BUNKERWEB_MAX_RETRIES | No | Maximum number of retries for transient HTTP errors. | 3 |
| BUNKERWEB_BASIC_PASSWORD | No | Password for HTTP Basic authentication. | |
| BUNKERWEB_BASIC_USERNAME | No | Username for HTTP Basic authentication. | |
| BUNKERWEB_PROMPT_CATALOG | No | Custom tool-prompt JSON path; unset uses the bundled catalog. | |
| BUNKERWEB_REDACT_PATTERN | No | Regular expression that replaces the built-in sensitive setting name pattern. | |
| BUNKERWEB_REDACT_SECRETS | No | Mask values of sensitive settings in tool and resource outputs. | false |
| BUNKERWEB_WEBSOCKET_TOKEN | No | Shared secret for legacy RPC/WebSocket access; also required on MCP HTTP when runtime logs are enabled. | |
| BUNKERWEB_RETRY_BACKOFF_MAX | No | Maximum backoff delay in seconds. | 5.0 |
| BUNKERWEB_RETRY_BACKOFF_INITIAL | No | Initial backoff delay in seconds. | 0.5 |
| BUNKERWEB_REQUEST_TIMEOUT_SECONDS | No | HTTP request timeout in seconds. | 30.0 |
| MCP_ENABLE_DNS_REBINDING_PROTECTION | No | Enable DNS rebinding protection for MCP endpoints. | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| authenticateB | Returns a new BunkerWeb API token; changes nothing in the BunkerWeb configuration. |
| pingA | Check that the BunkerWeb API answers (GET /ping, returns pong). Use it as the fastest liveness probe; use diagnose to also check authentication, version and instances. |
| healthA | Read the API's own liveness probe (GET /health); it does not contact instances. Use instances_ping_all for instances and diagnose for auth and version checks. |
| diagnoseB | Read-only check of the connected BunkerWeb: reachability, authentication, version, MULTISITE, instances, and optionally who owns a service's settings. |
| list_instancesA | List every registered BunkerWeb instance with its status. Results may be cached up to 60 s. Use instance_get for one host, instances_ping_all for live reachability. |
| instances_ping_allA | Ping every registered instance live and report which answer. Use instance_ping for one host; list_instances returns registration data without pinging. |
| instances_stop_allA | Stop every registered instance; traffic stops until they restart. Use instance_stop for one host. Acts on the instances immediately. |
| instance_getA | Fetch one registered instance by hostname. Results may be cached up to 60 s. Use list_instances to find hostnames, instance_ping to test reachability. |
| instance_pingA | Ping one instance live by hostname. Use instances_ping_all for every instance; instance_get returns the stored record without pinging. |
| instance_stopA | Stop one instance by hostname; it serves no traffic until restarted. Use instances_stop_all for all. Acts on the instances immediately. |
| instance_createA | Register a new instance for the scheduler to manage. Use instance_update to change one. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| instance_updateA | Change a registered instance; omitted fields keep their value. Use instance_create for a new host. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| instances_delete_bulkA | Unregister several UI/API-registered instances; the hosts keep running. Use instance_delete for one. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| instance_deleteA | Unregister one UI/API-registered instance; the host keeps running. Use instances_delete_bulk for several. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| reload_instancesA | Reload configuration on every instance, testing it first by default. Use reload_instance for one host. Acts on the instances immediately. |
| reload_instanceA | Reload configuration on one instance, testing it first by default. Use reload_instances for all. Acts on the instances immediately. |
| list_bansA | List active IP bans as reported by each instance. Results may be cached up to 30 s. It gives the exact IPs and services for unban_ip when writes are enabled. |
| ban_ipA | Ban one or more IPs, globally or per service, for exp seconds (0 = permanent). Use unban_ip to lift a ban. Acts on the instances immediately. |
| unban_ipA | Lift bans for one or more IPs, globally or per service. Use list_bans first to find them. Acts on the instances immediately. |
| list_servicesA | List services with their configuration and dates. Results may be cached up to 5 min. Use get_service to read one service in detail. |
| get_serviceA | Read one service's settings by ID; full=true adds defaults. Cached up to 5 min. Use list_services to find IDs, global_config_read for global settings. |
| create_serviceA | Create a service from SERVER_NAME and optional settings. Use update_service to change one. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| update_serviceA | Change a service's settings; skips unknown or externally owned keys and reads back the result. Use global_config_update for global settings. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| delete_serviceA | Delete a service and all its settings; not reversible. Use convert_service to take it offline. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| convert_serviceA | Switch a service between online and draft without deleting it. Use delete_service to remove it. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| global_config_readA | Read global settings; full=true adds defaults. Results may be cached up to 10 min. Use get_service for one service's settings. |
| global_config_updateA | Set global settings from key-value pairs; other settings are kept. Use update_service for one service. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| configs_listA | List custom config snippets (service, type, name), optionally with content. Use config_get to read one snippet in full. |
| config_getA | Read one custom config snippet with its content by service, type and name. Use configs_list to find snippets. |
| config_createA | Create one custom config snippet from text. Use configs_upload for several files. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| config_updateA | Edit, rename or move one snippet from text; omitted fields keep their value. Use config_upload_update to send a file. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| config_deleteA | Delete one custom config snippet. Use configs_delete_bulk for several. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| configs_delete_bulkA | Delete several custom config snippets in one call. Use config_delete for one. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| configs_uploadA | Create snippets from base64 files, one per file, named after the file. Use config_create for text. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| config_upload_updateA | Replace one snippet's content from a base64 file; without new_name the file stem renames it. Use config_update for text. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| plugins_listA | List installed plugins, filtered by type (all, external, ui, pro). type=ui lists the IDs accepted by plugin_delete when writes are enabled; use jobs_list for jobs. |
| plugins_uploadA | Install UI plugins from base64 archives; an existing plugin ID is refused. Use plugin_delete first to replace a UI plugin. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| plugin_deleteA | Uninstall one UI-installed plugin by ID; other plugins are refused. Use plugins_list with type=ui to find IDs. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live. |
| cache_listA | List files that scheduler jobs cached, filtered by service, plugin or job. Use cache_fetch_file to read one file. |
| cache_delete_bulkA | Delete several job cache files. Use cache_delete_file for one; jobs_run regenerates them. Queued for the scheduler; this tool cannot confirm it ran. |
| cache_fetch_fileA | Read one job cache file, keyed as listed by cache_list. Returns printable text, or base64 bytes with download=true. Use cache_list to find files. |
| cache_delete_fileA | Delete one job cache file. Use cache_delete_bulk for several; jobs_run regenerates it. Queued for the scheduler; this tool cannot confirm it ran. |
| jobs_listA | List scheduler jobs with their run history and cache metadata. Use cache_list for the files they wrote, and jobs_run when writes are enabled to trigger them. |
| jobs_runA | Trigger the jobs of one or more plugins, e.g. after cache_delete_file. Use jobs_list to check results. Queued for the scheduler; this tool cannot confirm it ran. |
| search_bunkerweb_docsA | Search the official BunkerWeb documentation by meaning (remote semantic search). Returns titled sections with URL, category and relevance, one per document. Use it for how-to and setting questions; use the API tools to read live state. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| authenticate | Suggested context for the 'authenticate' tool. |
| ping | Suggested context for the 'ping' tool. |
| health | Suggested context for the 'health' tool. |
| list_instances | Suggested context for the 'list_instances' tool. |
| instances_ping_all | Suggested context for the 'instances_ping_all' tool. |
| instances_stop_all | Suggested context for the 'instances_stop_all' tool. |
| instance_get | Suggested context for the 'instance_get' tool. |
| instance_ping | Suggested context for the 'instance_ping' tool. |
| instance_stop | Suggested context for the 'instance_stop' tool. |
| instance_create | Suggested context for the 'instance_create' tool. |
| instance_update | Suggested context for the 'instance_update' tool. |
| instances_delete_bulk | Suggested context for the 'instances_delete_bulk' tool. |
| instance_delete | Suggested context for the 'instance_delete' tool. |
| reload_instances | Suggested context for the 'reload_instances' tool. |
| reload_instance | Suggested context for the 'reload_instance' tool. |
| list_bans | Suggested context for the 'list_bans' tool. |
| ban_ip | Suggested context for the 'ban_ip' tool. |
| unban_ip | Suggested context for the 'unban_ip' tool. |
| list_services | Suggested context for the 'list_services' tool. |
| get_service | Suggested context for the 'get_service' tool. |
| create_service | Suggested context for the 'create_service' tool. |
| update_service | Suggested context for the 'update_service' tool. |
| delete_service | Suggested context for the 'delete_service' tool. |
| convert_service | Suggested context for the 'convert_service' tool. |
| global_config_read | Suggested context for the 'global_config_read' tool. |
| global_config_update | Suggested context for the 'global_config_update' tool. |
| configs_list | Suggested context for the 'configs_list' tool. |
| config_get | Suggested context for the 'config_get' tool. |
| config_create | Suggested context for the 'config_create' tool. |
| config_update | Suggested context for the 'config_update' tool. |
| config_delete | Suggested context for the 'config_delete' tool. |
| configs_delete_bulk | Suggested context for the 'configs_delete_bulk' tool. |
| configs_upload | Suggested context for the 'configs_upload' tool. |
| config_upload_update | Suggested context for the 'config_upload_update' tool. |
| plugins_list | Suggested context for the 'plugins_list' tool. |
| plugins_upload | Suggested context for the 'plugins_upload' tool. |
| plugin_delete | Suggested context for the 'plugin_delete' tool. |
| cache_list | Suggested context for the 'cache_list' tool. |
| cache_delete_bulk | Suggested context for the 'cache_delete_bulk' tool. |
| cache_fetch_file | Suggested context for the 'cache_fetch_file' tool. |
| cache_delete_file | Suggested context for the 'cache_delete_file' tool. |
| jobs_list | Suggested context for the 'jobs_list' tool. |
| jobs_run | Suggested context for the 'jobs_run' tool. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Global Configuration | Current BunkerWeb global configuration with all settings |
| Job Execution History | Scheduler jobs with their execution history and status |
| Active IP Bans | List of currently active IP bans with expiry and reason |
| Instance Status | Current status and health of all registered BunkerWeb instances |
| bunkerweb | Use when installing, deploying, configuring or upgrading BunkerWeb, the open-source WAF and reverse proxy, or when asked to protect a web app with a WAF or put BunkerWeb in front of a service. Covers Docker, Docker autoconf labels, Kubernetes ingress and Helm, Linux packages and the all-in-one image; global vs per-service settings and multisite prefixes; reverse proxy to an upstream; Let's Encrypt; SECURITY_MODE detect then block; verifying protection with curl. Symptoms include "put BunkerWeb in front of my app", "BunkerWeb docker-compose", "BunkerWeb ingress controller", "enable antibot on one host", "BunkerWeb Let's Encrypt", "upgrade BunkerWeb". Not for a setting that was already added and has no effect; use bunkerweb-troubleshooting. |
| references/all-in-one.md | |
| references/apps/authentik.md | |
| references/apps/directus.md | |
| references/apps/drupal.md | |
| references/apps/forgejo.md | |
| references/apps/grafana.md | |
| references/apps/home-assistant.md | |
| references/apps/immich.md | |
| references/apps/jellyfin.md | |
| references/apps/keycloak.md | |
| references/apps/netbird.md | |
| references/apps/nextcloud.md | |
| references/apps/paperless-ngx.md | |
| references/apps/pi-hole.md | |
| references/apps/seafile.md | |
| references/apps/synapse.md | |
| references/apps/tomcat.md | |
| references/apps/tuwunel.md | |
| references/apps/uptime-kuma.md | |
| references/apps/vaultwarden.md | |
| references/apps/wordpress.md | |
| references/apps/xen-orchestra.md | |
| references/autoconf.md | |
| references/docker.md | |
| references/kubernetes.md | |
| references/linux.md | |
| bunkerweb-migrate | Use when moving to BunkerWeb from a source that has no dedicated migration skill (Envoy, IIS, Zoraxy, a cloud WAF or CDN rule set, a hand-rolled OpenResty setup), or from an estate that mixes several sources. Runs the shared five-step migration (inventory, map, custom-config fallback, parallel detect run, cutover with a written rollback), maps each row from BunkerWeb's own `plugin.json` files, and routes every part of the estate that has a dedicated skill (nginx, Nginx Proxy Manager, SWAG, ingress-nginx, Traefik, Caddy, Apache httpd, HAProxy, standalone ModSecurity) to it. Symptoms include "convert my Envoy config to BunkerWeb", "migrate IIS to BunkerWeb", "Cloudflare WAF rules to BunkerWeb", "I run nginx, Traefik and Caddy and want one BunkerWeb". |
| bunkerweb-migrate-apache | Use when moving Apache httpd to BunkerWeb (`VirtualHost`, `ProxyPass`, `ProxyPassReverse`, `RequestHeader`, `Require ip`, `RewriteRule`, `mod_proxy`, `.htaccess`). Maps each vhost directive to a BunkerWeb setting, flags what Apache never enforced (`LimitRequestBody` on proxied bodies), runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Checked against a live Apache 2.4 and BunkerWeb 1.6.15. Symptoms include "Apache vhost to BunkerWeb", "replace Apache httpd with BunkerWeb", "ProxyPass to BunkerWeb", "convert my httpd config to BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-caddy | Use when moving Caddy to BunkerWeb (a Caddyfile, `reverse_proxy`, `handle` and `handle_path`, `header_up`, `basic_auth`, `tls`, and Caddy's automatic HTTPS with its stored certificates). Maps each Caddyfile directive to a BunkerWeb setting, turns on the certificate source that Caddy provided by itself, runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Symptoms include "Caddyfile to BunkerWeb", "replace Caddy with BunkerWeb", "Caddy reverse_proxy to BunkerWeb", "Caddy automatic HTTPS in BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-haproxy | Use when moving HAProxy to BunkerWeb (`haproxy.cfg`, `frontend`, `backend`, `acl`, `use_backend`, `http-request`, `stick-table`, `bind ... ssl crt`). Maps the HTTP frontends to BunkerWeb settings, turns `mode tcp` frontends into stream services, lists what has no setting (balancing across several servers, `tcp-request` rules), runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Checked against a live HAProxy 3.4 and BunkerWeb 1.6.15. Symptoms include "haproxy.cfg to BunkerWeb", "replace HAProxy with BunkerWeb", "HAProxy ACL to BunkerWeb", "HAProxy stick-table rate limit in BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-ingress-nginx | Use when moving Kubernetes Ingress objects served by ingress-nginx to BunkerWeb's ingress controller (`nginx.ingress.kubernetes.io/*` annotations, `ingressClassName` set to `nginx`, the ingress-nginx ConfigMap, the minikube `ingress` addon). Converts each annotation to a `bunkerweb.io/` annotation on the same Ingress under the `bunkerweb` class, lists what has no equivalent (snippets, canary, mirror, session affinity), runs both controllers side by side in detect mode, then cuts over by DNS with a written rollback. The Kubernetes project retired ingress-nginx in March 2026. Symptoms include "ingress-nginx is retired, move to BunkerWeb", "my rewrite-target annotation in BunkerWeb", "whitelist-source-range in BunkerWeb", "limit-rps in BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-modsecurity | Use when moving a standalone ModSecurity or OWASP CRS installation to BunkerWeb, namely the `owasp/modsecurity-crs` container (nginx or Apache), or ModSecurity on nginx or Apache with your own rule files (`SecRule` files, `SecRuleRemoveById`, `SecRuleUpdateTargetById` and `ctl:` exclusions, `crs-setup.conf` values, paranoia level, anomaly thresholds, `SecRuleEngine`, body limits, CRS plugins). BunkerWeb already runs ModSecurity with the CRS, so this moves only your own rules and settings into the right custom config type, replays the same requests against both in detect mode comparing rule ids, then cuts over with a written rollback. Checked against both CRS images and BunkerWeb 1.6.15. Symptoms include "move my ModSecurity rules to BunkerWeb", "port my CRS exclusions to BunkerWeb", "modsecurity.conf to BunkerWeb settings", "SecRuleRemoveById in BunkerWeb", "my CRS paranoia level on BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-nginx | Use when converting an nginx configuration to BunkerWeb settings (nginx.conf, a sites-enabled or conf.d server block, `location`, `proxy_pass`, `upstream`, `client_max_body_size`, `allow`/`deny`). Inventories the server and location blocks, maps each directive to a BunkerWeb setting, moves what has no setting into a custom config, runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Symptoms include "convert my nginx.conf to BunkerWeb", "nginx server block to BunkerWeb settings", "proxy_pass to BunkerWeb", "replace my nginx reverse proxy with BunkerWeb". Only for a hand-written nginx config. For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-nginx-proxy-manager | Use when moving Nginx Proxy Manager (NPM) to BunkerWeb (proxy hosts, redirection hosts, streams, access lists, "Block Common Exploits", custom locations, the Advanced tab, and NPM's Let's Encrypt certificates). Reads each host from NPM's API, its generated `proxy_host/<id>.conf` files or a copy of its database, maps every option to a BunkerWeb setting, handles the certificates and the port 80 conflict, runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Symptoms include "migrate from Nginx Proxy Manager to BunkerWeb", "replace NPM with BunkerWeb", "my NPM proxy hosts to BunkerWeb", "NPM access list in BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-swag | Use when moving linuxserver SWAG (Secure Web Application Gateway, `lscr.io/linuxserver/swag`) to BunkerWeb (`proxy-confs/*.subdomain.conf`, `*.subfolder.conf`, `proxy.conf`, `ssl.conf`, `URL`, `SUBDOMAINS`, `VALIDATION`, `DNSPLUGIN`, fail2ban `jail.local`, `.htpasswd`). Maps each proxy conf and the certificate environment to BunkerWeb settings, maps the fail2ban jails, flags what SWAG did that BunkerWeb does not (`proxy_redirect`, unlimited body size, extra `X-Forwarded-*` headers), runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Symptoms include "replace SWAG with BunkerWeb", "linuxserver swag proxy-confs to BunkerWeb", "swag fail2ban to BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-migrate-traefik | Use when moving Traefik to BunkerWeb (Docker `traefik.*` labels, `dynamic.yml` or file-provider routers, services and middlewares, entrypoints, `certresolver` and `acme.json`). Converts each router and middleware to BunkerWeb autoconf labels (`bunkerweb.*`), lists what has no equivalent, builds the autoconf stack, runs BunkerWeb in parallel in detect mode, then cuts over with a written rollback. Symptoms include "replace Traefik with BunkerWeb", "Traefik labels to BunkerWeb labels", "Traefik middlewares to BunkerWeb", "Traefik ipallowlist in BunkerWeb". For any other source, use `bunkerweb-migrate`, which routes to the skill for it. |
| references/mapping.md | |
| references/verified-live.md | |
| bunkerweb-modsecurity-crs-tuning | Use when tuning ModSecurity or OWASP CRS on BunkerWeb, clearing a WAF false positive where a legitimate request gets 403, or writing a BunkerWeb custom config of type modsec, modsec-crs, crs-plugins-before or crs-plugins-after. Symptoms include "ModSecurity blocks a valid request", "OWASP CRS false positive", "949110 Inbound Anomaly Score Exceeded", "my exclusion does nothing", "SecRuleRemoveById has no effect", "which folder do I put the rule in", "how do I disable rule 942100 for one path", "CRS exclusion for one URL". |
| reference.md | |
| bunkerweb-troubleshooting | Use when BunkerWeb blocks, bans or breaks something and the cause is unknown. Covers 403 Forbidden on a legitimate request, "You have been banned", 502 or 504 from the reverse proxy, Let's Encrypt certificate failures, a setting or label that has no effect, the web UI not reaching BunkerWeb, and reloads that fail. Maps the status code and log signature to the BunkerWeb module that fired (bad behavior, antibot, blacklist, DNSBL, country, limit, ModSecurity), lists and lifts bans, and whitelists correctly. Symptoms include "BunkerWeb 403", "403 page after putting BunkerWeb in front of my site", "what is blocking my form", "BunkerWeb banned me", "how to unban an IP", "BunkerWeb 502 bad gateway", "setting not applied", "I added a setting, restarted, and nothing changed", "why is my setting ignored", "label ignored", "Let's Encrypt failed BunkerWeb". |
| references/modules.md |
TDQS
Scored across 45 tools
Most tools have distinct purposes and the descriptions actively cross-reference alternatives, which helps separate similar operations like ping/health/diagnose and list_instances/instance_get. However, there are still several clusters where boundaries require careful reading, especially monitoring tools, single-vs-bulk instance operations, and service versus global configuration tools.
Naming mixes verb_noun patterns (list_services, get_service, create_service) with noun_verb and singular/plural prefixes (instance_get, instances_ping_all, config_get, configs_list, cache_delete_file, jobs_run). The prefixes make tools readable, but the convention is not predictable across the set.
With 45 tools, the surface is very large for an MCP server and exceeds the typical well-scoped range. While the domain is broad, many near-sibling operations could be consolidated or grouped to reduce selection burden.
The tool set covers core BunkerWeb administration well: authentication, services, instances, bans, global config, custom configs, plugins, cache/jobs, and documentation search. Some lifecycle gaps remain, such as richer plugin management and job creation/management, but agents can work around most missing operations.