coreyhines/opnsense-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_SECRET_KEY | Yes | Secret key for MCP communication | |
| OPNSENSE_API_KEY | Yes | Your OPNsense API key | |
| OPNSENSE_API_SECRET | Yes | Your OPNsense API secret | |
| OPNSENSE_FIREWALL_HOST | Yes | Your firewall host |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| aliasB | Manage firewall aliases, the named address and port groups rules reference. Call action='help' for each action's fields and rules. |
| bgpC | FRR BGP: peering state and neighbours. FRR ships disabled, so an empty result usually means it has not been turned on yet. Call action='help' for each action's fields and rules. |
| config_backupC | Configuration backups, revision history and boot environment snapshots. Call action='help' for each action's fields and rules. |
| fw_ruleC | Firewall filter rules, and the interface groups a rule can target so one rule covers several networks. Call action='help' for each action's fields and rules. |
| dhcpB | DHCP: leases, static reservations, ranges, options and per-subnet DNS. Call action='help' for each action's fields and rules. |
| dns_overrideA | Manage Unbound host overrides. Call action='help' for each action's fields and rules. |
| ipv6C | IPv6: NPTv6 prefix translation, virtual IPs, router advertisements, and planning or applying a ULA conversion. Call action='help' for each action's fields and rules. |
| interface_deviceC | Create the devices interfaces are built on: 802.1Q VLANs and loopbacks. Call action='help' for each action's fields and rules. |
| nat_outboundC | Outbound source NAT rules and how they are generated. Call action='help' for each action's fields and rules. |
| routingA | Static routes and gateways. Note routes use |
| diagnosticsA | Read-only views of what the firewall currently sees: neighbours, interfaces, state table, logs, captures, and reachability. Call action='help' for each action's fields and rules. |
| shaperB | Traffic shaper: pipes, queues, rules, and applying or auditing them. Call action='help' for each action's fields and rules. |
| arpC | Show ARP/NDP table |
| systemA | Show system status information |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Each tool generally maps to a distinct OPNsense module, so firewall rules, NAT, aliases, routing, DHCP, and other concerns are clearly separated. Minor overlap exists among system, diagnostics, and arp for read-only status information, and ipv6 is broad, but the descriptions provide enough boundaries.
Tool names follow a consistent lowercase domain-module convention, with snake_case for compound names like config_backup, dns_override, and nat_outbound. They do not use a verb-noun pattern, but the naming is predictable and uniform across the set.
Fourteen tools is well within the ideal range, and each tool represents a coherent functional area of an OPNsense firewall. There are no redundant or filler tools that make the surface feel bloated.
The set covers core firewall workflows: filtering, NAT, aliases, routing, DHCP, DNS overrides, traffic shaping, diagnostics, and backups. However, major OPNsense areas such as VPN configuration, certificate management, interface assignment, and general Unbound settings are absent, which could create dead ends for common tasks.