opnsense-guard-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_HOST | No | HTTP listen address | 127.0.0.1 |
| MCP_PORT | No | HTTP listen port | 8848 |
| MCP_TLS_KEY | No | TLS private key file for serving HTTPS | |
| MCP_TLS_CERT | No | TLS certificate file for serving HTTPS | |
| OPNSENSE_URL | Yes | Base URL of the OPNsense firewall, e.g. https://firewall.example.internal | |
| MCP_TRANSPORT | No | Transport to use: stdio or http | |
| OPNSENSE_API_KEY | Yes | API key for the least-privilege read-only OPNsense API user | |
| MCP_ALLOWED_HOSTS | No | Accepted Host headers (DNS-rebinding guard); defaults to localhost/127.0.0.1/MCP_HOST on the configured port | |
| MCP_TLS_CLIENT_CA | No | CA file used to require client certificates (mTLS) | |
| OPNSENSE_CA_BUNDLE | No | Path to the firewall CA bundle (alternative to OPNSENSE_VERIFY_SSL=false) | |
| MCP_ALLOWED_ORIGINS | No | Browser origins allowed; any other Origin is refused | |
| MCP_ALLOW_PLAINTEXT | No | Allow plain HTTP on a non-loopback address (only behind a TLS proxy) | false |
| NODE_EXTRA_CA_CERTS | No | Path to a CA file for Claude Code (Node) to trust a private CA when connecting to the MCP server | |
| OPNSENSE_API_SECRET | Yes | API secret for the least-privilege read-only OPNsense API user | |
| OPNSENSE_VERIFY_SSL | No | Set to false to disable TLS verification (alternative to OPNSENSE_CA_BUNDLE) | |
| OPNSENSE_GUARD_POLICY | No | Path to policy.yaml; without it the server is read-only | |
| MCP_RATE_LIMIT_PER_MIN | No | Requests per token per minute | 120 |
| OPNSENSE_WRITE_API_KEY | No | API key for a second, write-capable OPNsense API user; enables change tools when a write-mode policy is configured | |
| OPNSENSE_GUARD_DATA_DIR | No | Directory for the audit log, change journal and related data | ./data |
| OPNSENSE_WRITE_API_SECRET | No | API secret for the second, write-capable OPNsense API user; enables change tools when a write-mode policy is configured | |
| OPNSENSE_GUARD_TOKENS_FILE | No | File containing HTTP bearer token hashes | ./tokens.json |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| system_statusA | OPNsense firmware version and pending updates (needs the System: Firmware privilege). |
| system_informationB | Hostname, uptime, load, and general system information. |
| system_resourcesB | Memory, swap, and disk utilisation of the firewall itself. |
| service_listA | All services OPNsense knows about and whether each is running. |
| posture_checkA | Health snapshot: system, services, IDS state. Flags security-relevant services that are installed but not running. |
| suricata_statusB | Whether the Suricata IDS/IPS service is running, stopped, or disabled. |
| suricata_settingsB | Suricata configuration: enabled, IPS mode, interfaces, active rulesets. |
| suricata_alert_statusA | Whether Suricata is producing alerts, from its eve.json file metadata. OPNsense only serves alert rows over POST (queryAlerts), which a read-only server must not call. This reports liveness instead: the log file's size and last-modified time. Query alerts in your SIEM. |
| firewall_rulesA | The firewall filter ruleset, one line per rule. Use firewall_rule_get for every field of one rule. Args: search: optional text filter (interface, description, address). limit: maximum rules to return (1-1000). detail: return the full OPNsense rows instead of one-line summaries. |
| firewall_rule_getA | One filter rule by UUID, with all fields. Args: uuid: rule UUID as shown by firewall_rules. |
| firewall_aliasesB | Firewall aliases and their contents. Args: search: optional text filter on alias name or description. limit: maximum aliases to return (1-1000). |
| firewall_logB | Recent firewall log entries (pass/block decisions). Args: limit: number of log lines to return (1-1000). search: optional filter phrase (IP, port, interface, action). |
| firewall_statesB | Active connection state table. Args: limit: number of states to return (1-1000). search: optional filter on address or port. |
| system_logB | Recent entries from the OPNsense system log. Args: limit: number of lines to return (1-1000). |
| interfacesA | All network interfaces with status, addresses, and link state. |
| arp_tableA | ARP table: IP to MAC mappings currently known to the firewall. |
| routing_tableC | The firewall's active routing table. |
| dhcp_leasesA | Current DHCP leases across all backends (Kea, ISC dhcpd, dnsmasq). Queries all three and reports which backend actually holds leases. |
| raw_getB | GET any allowlisted OPNsense API path. The same read-only rules apply (prefix allowlist, verb denylist, no traversal), so this cannot change firewall state. Args: path: API path beginning with /api/, e.g. /api/core/firmware/info |
| policy_showA | What this server is allowed to change: mode, interfaces, networks, limits. Read this before planning a change so you know the limits. |
| security_auditA | Quick security review of the ruleset and IDS. Flags any->any pass rules, inbound pass on WAN, pass rules without logging, and an IDS that is not running. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 21 tools
Most tools target clearly distinct resources (suricata_status/settings/alert_status, firewall_rules/rule_get/log/states are well separated). Some softer overlap exists between posture_check and security_audit (both health/security snapshots) and among system_status/system_information/system_resources, but descriptions give enough signals to choose correctly.
All names are snake_case with predictable domain prefixes (system_, service_, suricata_, firewall_, dhcp_) and readable verb_noun forms for actions (posture_check, policy_show, security_audit). A few bare nouns (interfaces, arp_table, routing_table) deviate slightly but remain clear.
21 tools is on the heavy side for a read-only guard server; the suricata and system clusters each add several closely related tools. Every tool does earn a purpose, but the surface sits at the borderline of 'feels heavy'.
For a deliberately read-only server it covers system, services, IDS, firewall rules/aliases/logs/states, logs, interfaces, ARP, routing and DHCP well, with raw_get as an escape hatch for gaps. The notable gap is that policy_show references allowed changes but no mutation tools exist, which may confuse agents expecting lifecycle operations.