coreyhines/opnsense-mcp
This MCP server provides management and monitoring capabilities for an OPNsense firewall through natural language queries.
Network Discovery
View/filter ARP/NDP table by IP, MAC, or hostname
View DHCP leases (search by hostname/IP/MAC) and delete specific leases
View LLDP neighbor/topology table
Monitoring & Diagnostics
Retrieve firewall logs with filtering by action, source/destination IP, and protocol
Check system status and WAN gateway health (latency, packet loss)
Start, stop, and fetch packet captures with BPF filters and PCAP export
Firewall Rule Management
List, create, delete, enable/disable, and edit firewall rules
SSH fallback for creating rules when the API has limitations
DNS Management
List, add, and remove Unbound DNS host overrides (searchable by hostname/IP/description)
Aliases & Interfaces
List firewall aliases (IP/port groups) with search filtering
Retrieve available network interfaces for use in firewall rules
Provides tools for managing OPNsense firewall operations, including ARP, DHCP, logs, rules, interfaces, system status, and packet capture.
OPNsense MCP Server
MCP server for OPNsense firewall operations (ARP, DHCP, logs, rules, interfaces, system status, packet capture).
Use one of two deployment modes:
STDIO(local): best for Cursor/Claude Code/Continue running the server process directly.SSE(centralized): best for shared, long-lived service over HTTPS.
Demo
Query your firewall with Claude Code CLI. Live example with real network data:

Related MCP server: OPNSense MCP Server
Why This Exists
Built this because SSH'ing into the firewall to check logs or grab ARP data got old fast. Now you can ask Claude:
"What's happening on the network right now?"
"Show me the latest firewall blocks"
"Tell me about that host"
"Capture packets from the suspicious traffic"
Claude handles the firewall query via MCP and gives you analysis + context in one shot. Works on homelab or business deployments equally well.
Quick Start
1) Local setup (required for both modes)
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt
cp examples/.env.example ~/.envEdit ~/.env:
OPNSENSE_API_KEY=your_api_key
OPNSENSE_API_SECRET=your_api_secret
OPNSENSE_FIREWALL_HOST=your.firewall.host
MCP_SECRET_KEY=replace_me2) Choose mode
Mode A: STDIO (local IDE/client)
Configure your MCP client to launch mcp_start.sh:
{
"mcpServers": {
"opnsense-mcp": {
"command": "/bin/bash",
"args": ["/absolute/path/to/opnsense-mcp/mcp_start.sh"],
"cwd": "/absolute/path/to/opnsense-mcp"
}
}
}See full guide: docs/GETTING_STARTED.md.
Mode B: SSE (centralized service)
Run the Linux installer (Podman + quadlet + Caddy TLS):
sudo bash deploy/install.shClients connect to:
https://<your-hostname>/sseSee deployment docs:
What Is Available
Primary tools:
Discovery:
arp,dhcp,lldpMonitoring:
system,get_logs,packet_captureFirewall rules:
fw_rules,mkfw_rule,set_fw_rule,toggle_fw_rule,rmfw_ruleInterfaces:
interface_list
Full reference: docs/REFERENCE/FUNCTION_REFERENCE.md
What's New (June 2026)
Five PRs landed recently. See docs/FEATURES_UPDATE.md for full details and usage examples.
Streamable HTTP transport — native FastMCP server supports
stdio,sse, andstreamable-http(MCP spec 2025-03-26). Deployed viadeploy/install.sh.DHCP client_id (DUID) support —
mk_dhcp_hostandmove_dhcp_hostaccept an optional DUID for stateful DHCPv6 matching.Semver image tags — images are tagged from
pyproject.tomlversion + git short SHA (1.0.0-dev.a1b2c3d) or release tags (1.0.0).Container registry — pinned tags only;
:latestis rejected. SetOPNSENSE_MCP_IMAGE_REPO, or build locally with--build-local.install.sh readonly fix — Bash
readonlyclash betweeninstall.shandlib.shresolved.
Use Cases
Homelab network troubleshooting — Query firewall logs from terminal, get Claude's take on what's happening
Security operations — Automate incident triage: "Analyze the last hour of blocks"
Infrastructure automation — Write MCP-aware scripts that query firewall state dynamically
DevOps troubleshooting — Quick VLAN/interface status checks without SSH sessions
Feedback
First 10 users get feedback incorporated into the tool. If you find bugs or have ideas, file an issue or discussion.
Where to look first when reviewing
scripts/risk_map.py ranks source files by defect likelihood from git history —
churn times fix density — so a review reads the risky files first and can stop
early. It finds no bugs; it finds where they concentrate.
python3 scripts/risk_map.py --top 15CI runs it on every pull request alongside a complexity report (radon) and a
security-pattern pass (bandit) in the advisory Insights workflow, which
never blocks a merge. Thresholds that gate the build come later, once the
numbers are trusted.
Documentation Map
Start here:
docs/GETTING_STARTED.mdClaude Code specifics:
docs/CLAUDE_CODE_INTEGRATION.mdCentralized SSE spec:
docs/CENTRALIZED_DEPLOY_SPEC.mdContributor guide:
docs/DEVELOPMENT/CONTRIBUTING.md
License
This project is released under the MIT License.
Available Tools
14 toolsaliasB
Manage firewall aliases, the named address and port groups rules reference. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | [create] Alias name | |
| type | No | [create] Alias type, one of: host, network, port, url, urltable, geoip, networkgroup, mac, asn, dynipv6host, authgroup, internal, external | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| search | No | [list] Filter by alias name, type, or content | |
| confirm | No | Token returned by the previous call, to confirm. | |
| content | No | [create, update] Members: addresses, networks, ports or codes | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| description | No | Free-text note stored on the record. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of behavioral disclosure. It says 'Manage' but does not disclose staging/apply semantics, destructive operations, confirmation requirements, or return behavior. The schema hints at apply and confirm, but the description itself is silent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and a direct next-step instruction. There is no filler, and the help guidance earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, multi-action tool with no output schema and no annotations, the description is thin. However, the explicit 'call action=help' hand-off mitigates some gaps. It still omits staging/apply behavior, deletion confirmation, and return-value expectations, so it is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even without parameter details in the description. The 'action=help' hint is a useful addition, but the description does not explain individual parameters beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('firewall aliases') and clarifies that these are the named address and port groups that rules reference. This distinguishes it from siblings like fw_rule, though the verb 'Manage' is broad and does not enumerate the concrete actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction to call action='help' is actionable and gives the agent a path to discover each action's fields and rules. However, it does not explicitly contrast with sibling tools or state when this tool should be preferred over them; the context implies alias management but not exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
arpC
Show ARP/NDP table
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | Filter by IP address | |
| mac | No | Filter by MAC address | |
| search | No | Targeted search by IP/MAC/hostname |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states 'Show', implying a read-only operation, but does not explicitly confirm safety, describe output format, or mention any side effects or prerequisites. This is minimal disclosure for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler or redundant details. It is appropriately sized for a simple show command and front-loads the core purpose effectively.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and no annotations, yet the description provides only the barest functionality statement. It does not explain what the returned table looks like, how filters behave, or any limitations. For a tool with filters, this is incomplete context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (ip, mac, search) are already documented in the schema. The description adds no extra meaning about these filters, such as syntax or interaction between them, so it stays at the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('Show') and a specific resource ('ARP/NDP table'), which is distinct from the sibling tools. It is not a tautology and communicates the tool's core function immediately, though it does not explicitly contrast with siblings like 'diagnostics' or 'ipv6'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention any conditions, use cases, or exclusions, leaving the agent to infer from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bgpC
FRR BGP: peering state and neighbours. FRR ships disabled, so an empty result usually means it has not been turned on yet. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| bfd | No | [create_neighbor] Use BFD for fast failure detection | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| address | No | [create_neighbor] Peer address | |
| confirm | No | Token returned by the previous call, to confirm. | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| multihop | No | [create_neighbor] Peer is not on a directly connected subnet | |
| password | No | [create_neighbor] MD5 session password; stored in clear by OPNsense | |
| as_number | No | [configure] Local AS number. Required the first time BGP is enabled | |
| remote_as | No | [create_neighbor] Peer AS number. Give this or remote_as_mode, not both | |
| router_id | No | [configure] Router id, conventionally a loopback address | |
| description | No | Free-text note stored on the record. | |
| update_source | No | [create_neighbor] Interface to source the session from, e.g. lo0 | |
| remote_as_mode | No | [create_neighbor] internal or external, deriving the peer AS from the local one |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does add one useful trait: an empty result often means FRR has not been enabled. However, it omits that this tool can mutate system state (configure, create/delete/toggle_neighbor), presumably requires confirmation and staging in some actions, and may have irreversible effects. The description leans on the schema and the help action rather than disclosing these behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, only two sentences, and front-loads the domain before the critical empty-result caveat. No sentence is wasted. The first sentence is a fragment and could be a bit more explicit, but it does not bloate the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex – 15 parameters, 7 actions, no output schema, and no annotations – yet the description provides only the domain, one environment caveat, and a help-action instructon. The rich input schema compensates significantly, and the help action fills gaps. Still, the description does not cover side effects, when to use confirmed/staged flows, or relationship to siblings like 'routing', so it is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well-documented in the input schema. The description's pointer to action='help' adds a meta-layer for discovering per-action fields and rules, but it does not directly clarify individual parameter meanings. This matches the baseline of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'FRR BGP: peering state and neighbours' identifies the resource (FRR BGP) but lacks a verb; it reads like a label rather than a full statement of function. It does not explicitly say the tool can configure BGP or manage neighbors, which the action enum reveals. It is distinguishable from siblings like 'routing' by name, but the description itself is telegraphic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No alternatives or exclusion conditions are mentioned, and no sibling tools are referenced. The FRR-disabled caveat and the instruction to call action='help' provide operational context but do not tell an agent when to choose this tool over 'routing' or other siblings. Usage is implied by the resource name and scope rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_backupC
Configuration backups, revision history and boot environment snapshots. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | [list] Maximum revisions to return (default 25) | |
| rev_a | No | [diff] Older revision id, from list_config_backups | |
| rev_b | No | [diff] Newer revision id, from list_config_backups | |
| action | Yes | Operation to run. 'help' lists fields. | |
| provider | No | [diff, download, list] Backup provider id (default 'this') | |
| revision | No | [download] Revision id to fetch; omit for the running config | |
| description | No | Free-text note stored on the record. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral disclosure burden, but it only names resource areas and points to help. It does not reveal which actions are mutating, whether snapshots affect the boot environment, any side effects, or return behavior. There is no contradiction with annotations because none are provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short front-loaded sentences with no filler, and the second sentence gives a concrete next step. It is concise, though the first sentence is a noun fragment rather than a complete purpose statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex with 7 parameters and no output schema, and the description is not self-contained. However, the explicit action='help' instruction provides a viable discovery path for action-level rules, and the schema documents every parameter. It still lacks return shapes and side-effect warnings, making it adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents each parameter with action-scoped tags such as [list], [diff], and [download]. The description adds only the pointer to action='help' for action-specific fields and rules, which is a discovery aid rather than new parameter semantics; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the domain—configuration backups, revision history, and boot environment snapshots—and distinguishes it from sibling config-editing tools by resource type. However, it provides no verb: it never states what the tool does with these resources (e.g., create, diff, download, list), so the purpose must be inferred from the action enum in the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit entry strategy: call action='help' to get each action's fields and rules, which is useful for an agent unsure of sub-action semantics. It does not, however, explain when to choose config_backup over sibling tools or which scenarios call for backups/revisions versus live configuration changes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dhcpB
DHCP: leases, static reservations, ranges, options and per-subnet DNS. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | [delete_lease] IP address to delete | |
| mac | No | [create_host, delete_lease] MAC address (e.g. 'aa:bb:cc:dd:ee:ff') | |
| tag | No | [set_router] Tag uuid to scope to instead of an interface | |
| host | No | [delete_host, move_host] Hostname, MAC, or reservation uuid to delete | |
| ipv4 | No | [create_host, move_host] IPv4 address to assign (e.g. '172.20.8.50') | |
| ipv6 | No | [create_host, move_host] IPv6 suffix: integer (e.g. 50 → ::50) or '::abcd' | |
| slot | No | [set_dns] Optional slot index (1 or 2) for single-address updates | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| descr | No | [create_host, list_hosts] Optional description | |
| force | No | [set_router] Send the option even when the client did not ask | |
| action | Yes | Operation to run. 'help' lists fields. | |
| domain | No | [create_host, create_range, update_range] Optional domain for the host (e.g. 'lan') | |
| family | No | [set_dns] Address family to update: ipv4 or ipv6 | |
| router | No | [set_router] Gateway address to advertise | |
| search | No | [leases, list_hosts] Filter leases by hostname, IP, or MAC address. Omit for full table. | |
| subnet | No | [list_dns, set_dns, toggle_range] Subnet in CIDR notation (e.g. 172.20.2.0/24) | |
| confirm | No | Token returned by the previous call, to confirm. | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| end_addr | No | [create_range, update_range] Last address | |
| hostname | No | [create_host, delete_lease] Hostname for the reservation (e.g. 'mydevice') | |
| client_id | No | [create_host, move_host] Optional DHCP client identifier / DUID for IPv6 (e.g. '52:54:00:7e:9c:f4:00:ab:cd:01'). Accepts optional 'id:' prefix. | |
| interface | No | [create_range, list_dns, set_dns, set_router, toggle_range] Interface key, e.g. opt3 | |
| dns_server | No | [set_dns] Single DNS server address | |
| lease_time | No | [create_range, update_range] Seconds, or a suffixed value like 2h | |
| start_addr | No | [create_range, update_range] First address | |
| description | No | Free-text note stored on the record. | |
| dns_servers | No | [set_dns] One or two DNS server addresses | |
| subnet_mask | No | [create_range, update_range] subnet_mask | |
| missing_ipv6 | No | [list_hosts] When true, return only reservations with IPv4 but no ::N IPv6 suffix | |
| new_hostname | No | [move_host] New dnsmasq host reservation name (optional rename) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only says to call action='help' for rules, but it does not mention that many actions mutate state, that changes may be staged rather than applied, that some actions require a confirm token,, or that delete actions exist. The schema hints at these behaviors via 'apply' and 'confirm' params, but the description itself gives no behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences: the first states scope, the second gives an actionable pointer for details. No filler. For a tool with 31 params, this concise front-loaded structure is appropriate and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 31-parameter, 17-action tool with no output schema and no annotations, this description is not complete enough. It does give a useful help hook, but it fails to convey the breadth of actions, the mutation vs read distinction, the staging/confirmation model, or any guidance on choosing among sibling network tools. An agent can begin but cannot safely invoke correctly without extra calls and risky inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; the schema already documents all 31 parameters and their action-specific scoping. The description adds nothing about parameter semantics, only directing the user to action='help' for per-action field rules. It doesn't add value beyond schema but also doesn't mislead.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource domain clearly ('DHCP: leases, static reservations, ranges, options and per-subnet DNS') and distinguishes it from sibling tools by domain and resource types. It does not use a single specific verb, but for a multi-action dispatcher tool this is acceptable. The pointer to action='help' adds practical clarity about how to learn the available operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The scope statement implies 'use this for DHCP management', which is reasonable given sibling names like bgp, alias, and dns_override. It does not explicitly say when not to use this tool or name alternatives. The instruction to call action='help' for field and rules is useful usage guidance, but only within the tool, not between tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diagnosticsA
Read-only views of what the firewall currently sees: neighbours, interfaces, state table, logs, captures, and reachability. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | [pf_states] ip | |
| raw | No | [packet_capture] Return raw PCAP file if true (default: false) | |
| count | No | [packet_capture, ping] Packet count limit (optional) | |
| limit | No | [logs, pf_states] limit | |
| state | No | [pf_states] state | |
| action | Yes | Operation to run. 'help' lists fields. | |
| dst_ip | No | [logs, pf_states] dst_ip | |
| family | No | [ping] inet or inet6 (default inet) | |
| filter | No | [packet_capture] BPF filter expression (optional) | |
| src_ip | No | [logs, pf_states] src_ip | |
| stream | No | [packet_capture] If true, stream pcap data to chat (hex preview) | |
| target | No | [ping] Address or hostname to ping | |
| sort_by | No | [interface_health] sort_by | |
| summary | No | [pf_states] summary | |
| dst_port | No | [logs, pf_states] dst_port | |
| duration | No | [packet_capture] Duration in seconds (default: 30) | |
| protocol | No | [logs, pf_states] protocol | |
| src_port | No | [logs, pf_states] src_port | |
| interface | No | [interface_health, logs, packet_capture, pf_states] interface | |
| local_path | No | [packet_capture] Local path to save PCAP (optional) | |
| log_action | No | [logs] log_action | |
| packetsize | No | [ping] Payload bytes, for checking MTU on a transit | |
| include_raw | No | [interface_health, pf_statistics] include_raw | |
| max_results | No | [interface_health] max_results | |
| include_down | No | [interface_health] include_down | |
| summary_only | No | [logs] summary_only | |
| include_rules | No | [logs] include_rules | |
| preview_bytes | No | [packet_capture] Number of bytes to preview (default: 1000) | |
| warnings_only | No | [interface_health] warnings_only | |
| capture_action | No | [packet_capture] start, stop, or fetch (default: start) | |
| source_address | No | [ping] Source address, to test a specific path |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It explicitly declares 'Read-only views', which is the key safety trait. However, it does not surface nuances such as packet_capture's start/stop/fetch lifecycle or ping's active network probes, which a fully transparent description for a 9-action tool would mention.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with a concrete scope list and followed by a single high-value self-help instruction. No filler or redundant elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 31-parameter, 9-action tool with no output schema and no annotations, this description is deliberately broad and routes the agent to action='help' for per-action details. The schema's per-parameter action tags compensate for missing prose, but return semantics and per-action behavioral differences are not covered in the tool description itself.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter already has an action-tagged description, so the schema does the heavy lifting. The description only adds a meta-instruction to call action='help' for per-action fields and rules, which is useful but does not explain individual parameters. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific purpose: read-only views of the firewall's current state, listing six concrete domains (neighbours, interfaces, state table, logs, captures, reachability). This makes the tool's scope clear and distinguishes it from config-oriented siblings by the 'read-only' framing, though it does not explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Read-only views' qualifier gives clear context: use this for inspecting current firewall state rather than modifying configuration. The explicit instruction to call action='help' for each action's fields and rules is actionable entry-point guidance. It does not state exclusions or name sibling tools, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dns_overrideA
Manage Unbound host overrides. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | [flush] name: flush one hostname via unbound-control (default); restart: restart Unbound via API (clears full cache) | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| domain | No | [create] Domain (e.g. 'local' or 'example.com') | |
| search | No | [list] Filter by hostname, IP, or description | |
| server | No | [create, update] IP address this hostname resolves to | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| hostname | No | [create, flush] Hostname (without domain, e.g. 'myserver') | |
| description | No | Free-text note stored on the record. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only says 'call action=help' and reveals nothing about side effects, whether changes are staged or applied immediately, restart/flush semantics, or other behavioral traits. The schema has hints, but the description itself is very thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The purpose is front-loaded and the help pointer is actionable, making this efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 10 parameters, no annotations, and no output schema, the description is minimal. The action='help' escape hatch mitigates missing details, but the description alone doesn't explain behavior, prerequisites, or when to use this tool versus alternatives. It is barely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description's tip to use action='help' adds a meta-level way to get per-action rules, which is helpful but does not add meaning beyond the schema's built-in documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource ('Unbound host overrides') and a verb ('Manage'), making the tool's domain clear. It doesn't enumerate the specific actions, but the schema's action enum covers that. The resource name distinguishes it from sibling tools like alias, bgp, or dhcp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent to call action='help' for each action's fields and rules, which is a concrete usage directive. It doesn't contrast with sibling tools, but the specific resource makes the intended context clear and no exclusions are needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fw_ruleC
Firewall filter rules, and the interface groups a rule can target so one rule covers several networks. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| log | No | [update] Log packets matched by this rule | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| descr | No | [set_group] descr | |
| quick | No | [update] Stop evaluating further rules on a match | |
| action | Yes | Operation to run. 'help' lists fields. | |
| confirm | No | Token returned by the previous call, to confirm. | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| gateway | No | [create, update] gateway | |
| members | No | [set_group] Interface keys the group should contain, e.g. ['opt3', 'opt4']. This replaces the membership rather than adding to it. | |
| protocol | No | [create, list, update] protocol | any |
| direction | No | [create, update] direction | in |
| interface | No | [create, list, update] interface | lan |
| rule_uuid | No | [delete, toggle, update] UUID of the rule to delete | |
| ipprotocol | No | [create, update] ipprotocol | inet |
| source_net | No | [create, update] source_net | any |
| source_not | No | [update] Invert the source match | |
| description | No | Free-text note stored on the record. | |
| rule_action | No | [create, list, update] rule_action | pass |
| source_port | No | [create, update] source_port | any |
| interfacenot | No | [update] Invert the interface match | |
| destination_net | No | [create, update] destination_net | any |
| destination_not | No | [update] Invert the destination match | |
| destination_port | No | [create, update] destination_port | any |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does not mention that changes can be staged, that apply/confirm may be required, that delete/toggle are destructive, or that set_group replaces membership rather than appending.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise and front-loaded with the domain. The pointer to action='help' earns its place, though the overall terseness leaves behavioral aspects unaddressed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 24 parameters, 9 actions, no annotations, and no output schema. The description gives only a high-level domain and a help pointer, which is insufficient orientation for correct selection and invocation of all these operations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema does the heavy lifting for parameter semantics. The description's mention of interface groups adds mild context for group-related parameters, but it does not add meaningful meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource domain clearly: firewall filter rules and interface groups. However, it lacks a specific verb or action statement, leaving the actual operations to be inferred from the schema's action enum.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage guidance is to call action='help' for field-level details. There is no statement about when to use fw_rule versus sibling tools like nat_outbound or alias, and no exclusions or alternatives are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
interface_deviceC
Create the devices interfaces are built on: 802.1Q VLANs and loopbacks. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| pcp | No | [create_vlan] Priority code point | |
| tag | No | [create_vlan] VLAN id, 1 to 4094 | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| device | No | [delete_loopback] Device name, e.g. lo1. Given, the tool refuses to delete a device an interface is still assigned to | |
| parent | No | [create_vlan] Parent device, for example ax0 | |
| reason | No | [set_address] Recorded in the configuration history | |
| address | No | [set_address] IPv4 or IPv6 address | |
| confirm | No | Token returned by the previous call, to confirm. | |
| interface | No | [set_address] Interface identifier, e.g. opt12, from the assignment list | |
| description | No | Free-text note stored on the record. | |
| subnet_bits | No | [set_address] Prefix length; 32 or 128 for a loopback. 0 is refused: it would claim the whole address space on the interface | |
| planned_address | No | [create_loopback] An address you intend this loopback to carry. Not written here — OPNsense has no per-interface addressing API — but echoed back as the exact step to perform. Use set_interface_address to actually write one | |
| planned_subnet_bits | No | [create_loopback] Prefix length for planned_address, normally 32 or 128 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of explaining side effects and operational behavior. It only says resources are created and directs users to action='help'; it does not disclose deletion behavior, staging versus applying changes, failure modes, or consequences of actions despite some hints existing in parameter descriptions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loads the core purpose in the first sentence. The second sentence provides a useful pointer to action='help' without cluttering the main description, though the phrasing 'devices interfaces are built on' is grammatically awkward.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a multi-action tool with 15 parameters and no output schema or annotations, so a complete description would need to at least outline the main action categories and their effects. Instead, it mentions only creation and defers to dynamic help, leaving significant context for the agent to discover on its own.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the individual parameter descriptions are rich, including refusal cases and action-specific context. The tool description itself adds little parameter meaning, but with full schema coverage, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource—VLANs and loopbacks—and a create action, which gives some clarity. However, the action enum includes set_address, delete, and list operations that the description never mentions, so it understates the tool's actual scope and could mislead an agent into thinking it only creates resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus sibling tools such as ipv6, routing, or fw_rule. The instruction to call action='help' is a fallback for field details, not a usage guideline that helps an agent choose this tool appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ipv6C
IPv6: NPTv6 prefix translation, virtual IPs, router advertisements, and planning or applying a ULA conversion. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | [create_vip, set_advert] One of: ipalias, carp, proxyarp, other (default ipalias) | |
| uuid | No | Record to act on, identified by a list action. | |
| vhid | No | [create_vip] CARP virtual host id; required only for mode=carp | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| subnet | No | [create_vip] Address, without the prefix length | |
| confirm | No | Token returned by the previous call, to confirm. | |
| domains | No | [apply_ula] Subset of ['vip', 'npt', 'ra', 'unbound'], in that order | |
| dry_run | No | [apply_ula] Report what would run without doing it (default true) | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| trackif | No | [create_npt] Interface whose delegated prefix supplies the external side | |
| interface | No | [create_npt, create_vip] Interface the translation applies on, usually wan | |
| gua_prefix | No | [plan_ula] Current delegated prefix, for example 2001:db8:1::/64 | |
| source_net | No | [create_npt] Internal prefix, for example fd00:...:2::/64 | |
| ula_prefix | No | [plan_ula] Target ULA prefix of the same length | |
| description | No | Free-text note stored on the record. | |
| subnet_bits | No | [create_vip] Prefix length, e.g. 64 | |
| public_names | No | [plan_ula] Fully qualified names the outside world resolves; these keep their delegated address | |
| valid_lifetime | No | [set_advert] valid_lifetime | |
| destination_net | No | [create_npt] External prefix; omit when using trackif | |
| deprecate_prefix | No | [set_advert] Advertise the prefix as deprecated | |
| preferred_lifetime | No | [set_advert] Advertised preferred lifetime; 0 deprecates the prefix |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden. It names the feature areas but does not mention that many actions mutate state, that some changes are staged until apply, that confirmation tokens may be required, or that delete/toggle/apply actions exist. The help pointer is useful but not a substitute for behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler; the scope is front-loaded and the help pointer is useful. It is slightly too terse for such a complex multi-action tool, but as a concise overview it earns a 4.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 22-parameter, 12-action tool with no output schema and no annotations. The description only gives a high-level feature list and defers to an action='help' call, so an agent still lacks context about which action to choose, what each returns, prerequisites, and staged-vs-applied behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already adds per-parameter context such as [create_npt], [create_vip], and defaults like dry_run defaulting to true. The description itself contributes no parameter meaning beyond directing users to the help action, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the domain and resources: NPTv6 prefix translation, virtual IPs, router advertisements, and ULA conversion. It is clear about the tool's scope but does not use a single specific verb or contrast it with sibling tools, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool instead of siblings such as routing, interface_device, or nat_outbound. The only usage note is to call action='help' for each action's fields and rules, which helps within the tool but does not establish selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nat_outboundC
Outbound source NAT rules and how they are generated. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | [mode] When setting: one of automatic, hybrid | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| target | No | [create] Translation address; empty means the interface address | |
| confirm | No | Token returned by the previous call, to confirm. | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| interface | No | [create] Outgoing interface, usually wan | |
| source_net | No | [create] Source network or alias name to translate | |
| action_mode | No | [mode] get or set (default get) | |
| description | No | Free-text note stored on the record. | |
| static_port | No | [create] Preserve the source port | |
| destination_net | No | [create] Destination to match (default any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior, but it does not mention staged changes, apply semantics, confirm tokens, or that actions mutate state. Saying rules are 'generated' hints at behavior but remains vague for a stateful multi-action tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler and front-loads the resource name and the help directive. It earns its place, though its brevity contributes to the lack of behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 13 parameters, six actions, no annotations, and no output schema, a one-sentence description is insufficient for safe invocation. The schema covers parameter syntax, but the operational context—staging, apply behavior, confirm flow, and sibling differentiation—is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and parameter descriptions already include bracketed action contexts like [create] and [mode], so the schema does the heavy lifting. The description adds only the pointer to action='help' for per-action details, which is useful but minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource, 'Outbound source NAT rules,' and mentions how they are generated, which distinguishes it from general routing or firewall tools. However, it lacks an explicit operation verb; the actual actions only appear in the input schema enum.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus sibling tools such as fw_rule or routing. The only use instruction, 'Call action=help', explains how to explore fields but not when this tool should be selected.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
routingA
Static routes and gateways. Note routes use enabled and gateways use disabled, so a toggle means the opposite thing on each. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | [create_gateway] Gateway name | |
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| action | Yes | Operation to run. 'help' lists fields. | |
| confirm | No | Token returned by the previous call, to confirm. | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| gateway | No | [create_gateway, create_route] Next hop address | |
| network | No | [create_route] Destination prefix, for example 172.20.2.0/24 | |
| interface | No | [create_gateway] Interface identifier | |
| ipprotocol | No | [create_gateway] inet or inet6 (default inet) | |
| description | No | Free-text note stored on the record. | |
| far_gateway | No | [create_gateway] Next hop outside the interface subnet | |
| monitor_disable | No | [create_gateway] Turn off monitoring, usual for a point-to-point transit |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It discloses a genuinely important quirk: routes use 'enabled' while gateways use 'disabled,' so toggling means the opposite thing on each. However, it does not warn that delete/toggle operations are mutating, that changes may be staged, or that confirmation tokens are needed, so the behavioral picture remains incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the first states scope, the second warns about a non-obvious toggling asymmetry, and the third tells the agent how to get action-specific rules. There is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex: 13 parameters, 10 actions, and no output schema, so the description alone is light. The action='help' directive mitigates this by pointing to authoritative per-action rules, but the description does not cover overall workflows like list-then-confirm or whether changes apply immediately. It is adequate as a pointer but not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds crucial parameter semantics by explaining that 'enabled' vs 'disabled' has inverted meaning for routes vs gateways, which is not obvious from the schema's 'Target state, set explicitly rather than flipped.' It also directs the agent to action='help' for per-action field details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource domain as 'Static routes and gateways,' which clearly distinguishes it from dynamic routing siblings like bgp. It lacks an explicit verb like 'manage' or 'configure,' but the action enum in the schema supplies the operation vocabulary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Static routes and gateways' implies when this tool should be used, but it never names an alternative or states when not to use it. The instruction to call action='help' for each action's fields and rules is useful for learning the tool, but it is not guidance about selecting between sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shaperB
Traffic shaper: pipes, queues, rules, and applying or auditing them. Call action='help' for each action's fields and rules.
| Name | Required | Description | Default |
|---|---|---|---|
| uuid | No | Record to act on, identified by a list action. | |
| apply | No | Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one. | |
| proto | No | [create_rule, update_rule] proto | |
| action | Yes | Operation to run. 'help' lists fields. | |
| preset | No | [apply_preset] preset | bufferbloat_wan |
| weight | No | [create_queue, update_queue] weight | |
| confirm | No | Token returned by the previous call, to confirm. | |
| enabled | No | Target state, set explicitly rather than flipped. | |
| sequence | No | [create_rule] Rule order; auto-assigned when omitted | |
| bandwidth | No | [create_pipe, update_pipe] bandwidth | |
| direction | No | [create_rule, update_rule] direction | |
| fetch_all | No | [list_pipes, list_queues, list_rules] When true, paginate until all rows are returned | |
| interface | No | [create_rule, list_rules, update_rule] interface | |
| pipe_uuid | No | [create_queue, update_queue] pipe_uuid | |
| row_count | No | [list_pipes, list_queues, list_rules] Search API page size (default 50, max 500) | |
| scheduler | No | [create_pipe, update_pipe] scheduler | fq_codel |
| baseline_id | No | [statistics] Optional baseline id from a prior shaper_statistics call for pkts/bytes delta comparison | |
| description | No | Free-text note stored on the record. | |
| snapshot_id | No | [restore_snapshot] snapshot_id | |
| target_uuid | No | [create_rule, update_rule] target_uuid | |
| upload_mbit | No | [apply_preset] upload_mbit | |
| download_mbit | No | [apply_preset] download_mbit | |
| include_audit | No | [explain] When true, run audit first and weave findings into the narrative | |
| wan_interface | No | [apply_preset] wan_interface | wan |
| remove_orphans | No | [restore_snapshot] Delete live objects whose UUID is absent from the snapshot | |
| isp_upload_mbit | No | [audit] Reference ISP upload rate in Mbit/s | |
| bandwidth_metric | No | [create_pipe, update_pipe] bandwidth_metric | Mbit |
| capture_snapshot | No | [create_pipe, create_queue, create_rule, update_pipe, update_queue, update_rule] capture_snapshot | |
| isp_download_mbit | No | [audit] Reference ISP download rate in Mbit/s | |
| wan_line_rate_mbit | No | [audit] WAN physical line rate cap in Mbit/s | |
| mutation_snapshot_id | No | [create_pipe, create_queue, create_rule, update_pipe, update_queue, update_rule] mutation_snapshot_id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions applying and auditing, but does not disclose important behaviors like staged changes, snapshot/restore effects, confirm tokens, destructive operations, or the side effects of any of the many actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two compact clauses with no filler: it states the domain and provides a concrete self-service mechanism for deeper details. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 31 parameters, 26 actions, no annotations, no output schema, and complex operations like snapshots and audits, this one-sentence definition is not complete. Pointing to action='help' mitigates the gap, but the description still leaves selection, behavioral, and side-effect context entirely undisclosed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema itself documents all parameters, including action-name prefixes. The description adds no parameter meaning beyond pointing to the help action, which is useful but does not elevate it above the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a traffic shaper operating on pipes, queues, and rules, and mentions applying/auditing. This is understandable and domain-specific, though it does not differentiate it from siblings beyond the domain label.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives operational guidance by telling the agent to call action='help' for fields and rules, which is useful. However, it does not specify when to use this tool versus its siblings or when a particular action should be chosen.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
systemA
Show system status information
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. 'Show' correctly indicates read-only behavior, but no additional traits (e.g., authentication needs) are disclosed. It's minimal but accurate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, clear sentence. No wasted words; front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool, the description fully covers what the agent needs. Sibling tools are all more specific, so 'system status' is adequately contextualized.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and schema coverage is 100%. Per guidelines, no parameter info is needed, so the baseline of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Show' and the resource 'system status information', which is distinct from sibling tools like arp or dns. However, it lacks specificity about what constitutes system status (e.g., uptime, load), so it's not a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. While it's implied for general status checks, explicit context or exclusions are missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
29 tool updates
v1.0.0- Added
alias - Removed
aliases - Changed
arp3 fields changed- removed
Input schema / properties / ip / optionalRemoved value: -true - removed
Input schema / properties / mac / optionalRemoved value: -true - removed
Input schema / properties / search / optionalRemoved value: -true
- Added
bgp - Added
config_backup - Changed
dhcp33 fields changed- added
Input schema / properties / actionAdded value: +{ + "description": "Operation to run. 'help' lists fields.", + "enum": [ + "create_host", + "create_range", + "delete_host", + "delete_lease", + "delete_option", + "delete_range", + "leases", + "list_dns", + "list_hosts", + "list_options", + "list_ranges", + "move_host", + "set_dns", + "set_router", + "toggle_range", + "update_range", + "help" + ], + "type": "string" +} - added
Input schema / properties / applyAdded value: +{ + "description": "Apply now rather than leaving the change staged. The default differs by action; action='help' reports each one.", + "type": "boolean" +} - added
Input schema / properties / client_idAdded value: +{ + "description": "[create_host, move_host] Optional DHCP client identifier / DUID for IPv6 (e.g. '52:54:00:7e:9c:f4:00:ab:cd:01'). Accepts optional 'id:' prefix.", + "type": "string" +} - added
Input schema / properties / confirmAdded value: +{ + "description": "Token returned by the previous call, to confirm.", + "type": "string" +} - added
Input schema / properties / descrAdded value: +{ + "description": "[create_host, list_hosts] Optional description", + "type": "string" +} - added
Input schema / properties / descriptionAdded value: +{ + "description": "Free-text note stored on the record.", + "type": "string" +} - added
Input schema / properties / dns_serverAdded value: +{ + "description": "[set_dns] Single DNS server address", + "type": "string" +} - added
Input schema / properties / dns_serversAdded value: +{ + "description": "[set_dns] One or two DNS server addresses", + "items": { + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / domainAdded value: +{ + "description": "[create_host, create_range, update_range] Optional domain for the host (e.g. 'lan')", + "type": "string" +} - added
Input schema / properties / enabledAdded value: +{ + "description": "Target state, set explicitly rather than flipped.", + "type": "boolean" +} - added
Input schema / properties / end_addrAdded value: +{ + "description": "[create_range, update_range] Last address", + "type": "string" +} - added
Input schema / properties / familyAdded value: +{ + "description": "[set_dns] Address family to update: ipv4 or ipv6", + "type": "string" +} - added
Input schema / properties / forceAdded value: +{ + "description": "[set_router] Send the option even when the client did not ask", + "type": "boolean" +} - added
Input schema / properties / hostAdded value: +{ + "description": "[delete_host, move_host] Hostname, MAC, or reservation uuid to delete", + "type": "string" +} - added
Input schema / properties / hostnameAdded value: +{ + "description": "[create_host, delete_lease] Hostname for the reservation (e.g. 'mydevice')", + "type": "string" +} - added
Input schema / properties / interfaceAdded value: +{ + "description": "[create_range, list_dns, set_dns, set_router, toggle_range] Interface key, e.g. opt3", + "type": "string" +} - added
Input schema / properties / ipAdded value: +{ + "description": "[delete_lease] IP address to delete", + "type": "string" +} - added
Input schema / properties / ipv4Added value: +{ + "description": "[create_host, move_host] IPv4 address to assign (e.g. '172.20.8.50')", + "type": "string" +} - added
Input schema / properties / ipv6Added value: +{ + "description": "[create_host, move_host] IPv6 suffix: integer (e.g. 50 → ::50) or '::abcd'", + "type": [ + "integer", + "string" + ] +} - added
Input schema / properties / lease_timeAdded value: +{ + "description": "[create_range, update_range] Seconds, or a suffixed value like 2h", + "type": "string" +} - added
Input schema / properties / macAdded value: +{ + "description": "[create_host, delete_lease] MAC address (e.g. 'aa:bb:cc:dd:ee:ff')", + "type": "string" +} - added
Input schema / properties / missing_ipv6Added value: +{ + "description": "[list_hosts] When true, return only reservations with IPv4 but no ::N IPv6 suffix", + "type": "boolean" +} - added
Input schema / properties / new_hostnameAdded value: +{ + "description": "[move_host] New dnsmasq host reservation name (optional rename)", + "type": "string" +} - added
Input schema / properties / routerAdded value: +{ + "description": "[set_router] Gateway address to advertise", + "type": "string" +} - changed
Input schema / properties / search / descriptionPrevious value: -"Search by hostname/IP/MAC"New value: +"[leases, list_hosts] Filter leases by hostname, IP, or MAC address. Omit for full table." - removed
Input schema / properties / search / optionalRemoved value: -true - added
Input schema / properties / slotAdded value: +{ + "description": "[set_dns] Optional slot index (1 or 2) for single-address updates", + "type": "integer" +} - added
Input schema / properties / start_addrAdded value: +{ + "description": "[create_range, update_range] First address", + "type": "string" +} - added
Input schema / properties / subnetAdded value: +{ + "description": "[list_dns, set_dns, toggle_range] Subnet in CIDR notation (e.g. 172.20.2.0/24)", + "type": "string" +} - added
Input schema / properties / subnet_maskAdded value: +{ + "description": "[create_range, update_range] subnet_mask", + "type": "string" +} - added
Input schema / properties / tagAdded value: +{ + "description": "[set_router] Tag uuid to scope to instead of an interface", + "type": "string" +} - added
Input schema / properties / uuidAdded value: +{ + "description": "Record to act on, identified by a list action.", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[]New value: +[ + "action" +]
- Removed
dhcp_lease_delete - Added
diagnostics - Removed
dns - Added
dns_override - Added
fw_rule - Removed
fw_rules - Removed
gateway_status - Removed
get_logs - Added
interface_device - Removed
interface_list - Added
ipv6 - Removed
lldp - Removed
mkdns - Removed
mkfw_rule - Added
nat_outbound - Removed
packet_capture - Removed
rmdns - Removed
rmfw_rule - Added
routing - Removed
set_fw_rule - Added
shaper - Removed
ssh_fw_rule - Removed
toggle_fw_rule
19 tool updates
v1.8.0- First observed
aliases - First observed
arp - First observed
dhcp - First observed
dhcp_lease_delete - First observed
dns - First observed
fw_rules - First observed
gateway_status - First observed
get_logs - First observed
interface_list - First observed
lldp - First observed
mkdns - First observed
mkfw_rule - First observed
packet_capture - First observed
rmdns - First observed
rmfw_rule - First observed
set_fw_rule - First observed
ssh_fw_rule - First observed
system - First observed
toggle_fw_rule
TDQS
Scored across 14 tools
Each tool generally maps to a distinct OPNsense module, so firewall rules, NAT, aliases, routing, DHCP, and other concerns are clearly separated. Minor overlap exists among system, diagnostics, and arp for read-only status information, and ipv6 is broad, but the descriptions provide enough boundaries.
Tool names follow a consistent lowercase domain-module convention, with snake_case for compound names like config_backup, dns_override, and nat_outbound. They do not use a verb-noun pattern, but the naming is predictable and uniform across the set.
Fourteen tools is well within the ideal range, and each tool represents a coherent functional area of an OPNsense firewall. There are no redundant or filler tools that make the surface feel bloated.
The set covers core firewall workflows: filtering, NAT, aliases, routing, DHCP, DNS overrides, traffic shaping, diagnostics, and backups. However, major OPNsense areas such as VPN configuration, certificate management, interface assignment, and general Unbound settings are absent, which could create dead ends for common tasks.
Maintenance
Related MCP Connectors
Tailscale device, route, DNS, key, user, and ACL management over MCP and CLI.
Manage CloudPepper servers, Odoo instances, backups, and deployments over MCP.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
SecurityTrails MCP — wraps SecurityTrails API (securitytrails.com)
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server implementation for managing OPNsense firewalls. This server allows Claude and other MCP-compatible clients to interact with all features exposed by the OPNsense API.1AGPL 3.0
- AlicenseCqualityCmaintenanceA server that enables managing OPNSense firewalls through natural language interactions with Claude Desktop, supporting VLAN management, firewall rules configuration, and network interface queries.64221 npm82MIT
- AlicenseNot gradedqualityFmaintenanceA modular MCP server that provides access to over 2,000 OPNsense firewall management methods through 88 specialized tools. It enables AI assistants to securely manage firewall rules, network interfaces, and system diagnostics using a type-safe TypeScript interface.255 npm82MIT
- AlicenseAqualityDmaintenanceSlim OPNsense MCP Server — 62 tools for managing firewall infrastructure via the OPNsense REST API. Covers DNS/Unbound, Firewall rules, Diagnostics, Interfaces, DHCP (ISC + Kea), System/Backups, ACME/Let's Encrypt, and Firmware. No SSH, no shell, API-only with 3 runtime dependencies. AGPL-3.0 + Commercial dual-licensed.10054 npm2AGPL 3.0