Search aliases with advanced filtering options

Add or remove addresses from an existing alias

Create a new firewall alias

Update an existing alias by ID

Delete an alias by ID. WARNING: This is irreversible.

Search certificates configured on pfSense with optional filtering

Create or import a certificate on pfSense

Import and internal generation use different API endpoints with different required fields, so this routes on method.

Update an existing certificate by ID (idempotent)

Delete a certificate by ID. WARNING: This is irreversible.

Generate a new certificate signed by an existing CA on pfSense

Renew an existing certificate by ID

Export a certificate in PKCS#12 format

Search Certificate Authorities (CAs) configured on pfSense

Create or import a Certificate Authority on pfSense

Import and internal generation use different API endpoints; this routes on method.

Update an existing Certificate Authority by ID (idempotent)

Delete a Certificate Authority by ID. WARNING: This is irreversible.

Search Certificate Revocation Lists (CRLs) configured on pfSense

Create a Certificate Revocation List (CRL) on pfSense

Update a Certificate Revocation List (CRL) by ID

Delete a Certificate Revocation List (CRL) by ID. WARNING: This is irreversible.

Search DHCP leases with advanced filtering

Search DHCP static mappings (reservations) with filtering

Create a DHCP static mapping (reservation)

Lease times are not optional in effect: the API package materialises defaultleasetime 7200 and maxleasetime 86400 whenever the field is absent from the request, and a later PATCH sending an explicit null returns 200 but reads back unchanged. Pass the values you want at create time.

Whether the DHCP daemon acts on the per-host values is unverified. On an ISC deployment they were present in config.xml but absent from the generated dhcpd.conf; the Kea config was not readable.

Update an existing DHCP static mapping by ID

Only the parameters you pass are sent, so unset ones keep their stored values.

Delete a DHCP static mapping by ID. WARNING: This is irreversible.

Get DHCP server configuration including pool ranges, lease times, etc.

Update DHCP server configuration (pool range, lease times, etc.)

Search DHCP server address pools with filtering and pagination

Create a DHCP address pool for an interface

Update an existing DHCP address pool by ID

Delete a DHCP address pool by ID. WARNING: This is irreversible.

Search DHCP server custom options with filtering and pagination

Create a DHCP custom option

Update an existing DHCP custom option by ID

Delete a DHCP custom option by ID. WARNING: This is irreversible.

Apply pending DHCP server changes

Use this after making changes with apply_immediately=False to batch-apply them.

Update the DHCP server backend (ISC DHCP vs Kea)

Run a ping diagnostic from the pfSense firewall

Reboot the pfSense system. WARNING: This will cause a service interruption.

Halt (shut down) the pfSense system. WARNING: This will power off the system.

Get configuration history revisions with pagination

Get a specific configuration history revision by ID

Delete a configuration history revision by ID. WARNING: This is irreversible.

Search pf firewall tables with filtering and pagination

Get the contents of a specific pf firewall table

Compare two configuration revisions to see what changed.

If revision_id_after is not provided, compares against the current running config.

Search DNS Forwarder host overrides with filtering and pagination

Create a DNS Forwarder host override entry

Update an existing DNS Forwarder host override by ID

Delete a DNS Forwarder host override by ID. WARNING: This is irreversible.

Search aliases for a DNS Forwarder host override

Add or remove an alias for a DNS Forwarder host override

Apply pending DNS Forwarder changes

Use this after making changes with apply_immediately=False to batch-apply them.

Get the current DNS Resolver (Unbound) settings

Returns the full Unbound configuration including enable state, DNSSEC, forwarding mode, DHCP registration, and custom options.

Update DNS Resolver (Unbound) settings

Search DNS host overrides with filtering and pagination

Create a DNS host override entry

Update an existing DNS host override by ID

Delete a DNS host override by ID. WARNING: This is irreversible.

Search aliases for a specific DNS host override

Search DNS domain overrides with filtering and pagination

Create a DNS domain override entry

Update an existing DNS domain override by ID

Delete a DNS domain override by ID. WARNING: This is irreversible.

Search DNS Resolver access lists with pagination

Create a DNS Resolver access list entry

Apply pending DNS Resolver configuration changes

Sends a POST to the DNS Resolver apply endpoint to activate any pending host override, domain override, access list, or settings changes.

Update an existing DNS Resolver access list

Delete a DNS Resolver access list. WARNING: This is irreversible.

Search firewall rules with advanced filtering and pagination.

Find all firewall rules that block or reject traffic

Create a firewall rule on the live pfSense appliance.

WARNING: This modifies the running firewall configuration.

Move a firewall rule to a new position in the rule order

Update an existing firewall rule by ID

Delete a firewall rule from the live pfSense appliance. WARNING: This is irreversible.

Block multiple IP addresses on the live pfSense firewall. WARNING: Creates block rules.

Force apply pending firewall changes and recompile the pf ruleset.

Use this after any firewall config change to ensure the compiled ruleset (/tmp/rules.debug) matches the configuration. The apply_immediately parameter on other tools doesn't always trigger full recompilation.

Read the compiled pf ruleset (/tmp/rules.debug) to verify what pf is actually enforcing vs what's in config.xml.

Returns the raw compiled rules that the packet filter is using.

Search firewall schedules with filtering and pagination

Create a firewall schedule with an initial time range.

The pfSense API requires at least one time range at creation. Use create_schedule_time_range to add further ranges afterwards.

Update an existing firewall schedule by ID

Delete a firewall schedule by ID. WARNING: This is irreversible.

Search time ranges within a firewall schedule

Create a time range within a firewall schedule

Update an existing time range within a firewall schedule by ID

Delete a time range from a firewall schedule by ID. WARNING: This is irreversible.

Search firewall states (active connections) with filtering and pagination

Delete a specific firewall state (active connection) by ID. WARNING: This is irreversible.

Terminating a state will immediately drop the associated connection.

Get the current firewall state table size and limits

Returns the current number of active states and the configured maximum.

Get firewall advanced settings

Returns advanced firewall configuration including optimization mode, state timeout values, and other tuning parameters.

Search interface configurations with filtering and pagination

Each result carries an "id" of "wan", "lan", or "optN", which is what update_interface and delete_interface take as interface_id.

Create (assign) a network interface

Update an existing interface by ID

Delete (unassign) an interface by ID. WARNING: This is irreversible.

Apply pending interface changes

Use this after making changes with apply_immediately=False to batch-apply them.

Search VLANs with filtering and pagination

Create a VLAN

Update an existing VLAN by ID

Delete a VLAN by ID. WARNING: This is irreversible.

Search interface bridges with filtering and pagination

Create an interface bridge

Search interface groups with filtering and pagination

Create an interface group

Get a list of available (unassigned) network interfaces

Get firewall log entries with optional filtering

WARNING (tracked by upstream PR #860): this endpoint may fail on firewalls with large log files due to a known pfSense REST API bug (server-side OOM at the 512 MB PHP limit). If it fails, suggest reviewing logs via SSH or the pfSense web UI instead.

Analyze blocked traffic patterns from firewall logs.

Retrieves recent blocked log entries and groups them by source IP, showing hit counts, destination IPs, and a simple threat score. Firewall logs are raw text — IPs are extracted via pattern matching.

WARNING (tracked by upstream PR #860): this endpoint may fail on firewalls with large log files due to a known pfSense REST API bug (server-side OOM at the 512 MB PHP limit). If it fails, suggest reviewing logs via SSH or the pfSense web UI instead.

Read the newest lines from a pfSense log file (dhcpd, filter, resolver, system, auth).

Reads the plain-text log file server-side with tail (and grep when a pattern is given), so it works for log types the REST API log endpoints don't expose (notably resolver) and avoids the known server-side OOM bug on /status/logs/ endpoints.

Search logs for activity related to a specific IP address

WARNING (tracked by upstream PR #860): this endpoint may fail on firewalls with large log files due to a known pfSense REST API bug (server-side OOM at the 512 MB PHP limit). If it fails, suggest reviewing logs via SSH or the pfSense web UI instead.

Get the NTP service settings

Update the NTP service settings

Search NTP time servers with pagination

Add or remove an NTP time server

Search cron jobs with filtering and pagination

Create a cron job

Delete a cron job by ID. WARNING: This is irreversible.

Search service watchdogs with pagination

Add or remove a service watchdog entry

Get the SSH service settings

Update the SSH service settings

Send a Wake-on-LAN magic packet

Search NAT port forwarding rules with filtering and pagination

Create a NAT port forwarding rule

Delete a NAT port forwarding rule by ID. WARNING: This is irreversible.

Update an existing NAT port forwarding rule by ID

Search 1:1 NAT mappings with filtering and pagination

Create a 1:1 NAT mapping

Update an existing 1:1 NAT mapping by ID

Delete a 1:1 NAT mapping by ID. WARNING: This is irreversible.

Apply pending 1:1 NAT changes

Use this after making changes with apply_immediately=False to batch-apply them. This shares the firewall apply endpoint.

Search outbound NAT mappings with filtering and pagination

Create an outbound NAT mapping

Update an existing outbound NAT mapping by ID

Delete an outbound NAT mapping by ID. WARNING: This is irreversible.

Get the current outbound NAT mode (automatic, hybrid, advanced, or disabled)

Update the outbound NAT mode

Apply pending NAT changes (outbound mappings, mode changes)

Use this after making changes with apply_immediately=False to batch-apply them. This shares the firewall apply endpoint.

Search ACME (Let's Encrypt) certificates with filtering and pagination

Requires the ACME package to be installed on pfSense.

Create an ACME certificate entry

The pfSense API rejects a certificate with no domains ("Field a_domainlist is required"), so at least one domain/SAN validation entry must be provided at creation time.

Update an existing ACME certificate entry by ID

Delete an ACME certificate entry by ID. WARNING: This is irreversible.

List the domain (SAN) validation entries configured on an ACME certificate

The pfSense API embeds each certificate's domain list (a_domainlist) inline on the certificate object rather than exposing a standalone list endpoint, so this fetches the parent certificate and returns its domains.

Add or remove a domain (SAN) validation entry on an ACME certificate

Each ACME certificate needs at least one domain entry describing how pfSense proves ownership to Let's Encrypt (HTTP-01, DNS-01 via a provider API, manual DNS, etc.) before a certificate can be issued. This manages entries one at a time instead of replacing the whole a_domainlist array (see update_acme_certificate for a full-replace).

Issue (obtain) an ACME certificate from Let's Encrypt

Triggers the ACME challenge/validation process and obtains the certificate.

Renew an existing ACME certificate

Triggers the renewal process for a previously issued certificate.

Search ACME account keys with filtering and pagination

Create an ACME account key for Let's Encrypt

Register an ACME account key with the ACME server (Let's Encrypt)

This sends the account key to the ACME server and completes registration.

Get the current ACME package settings

Search BIND DNS zones with filtering and pagination

Requires the BIND package to be installed on pfSense.

Create a BIND DNS zone

Update an existing BIND DNS zone by ID

Delete a BIND DNS zone by ID. WARNING: This is irreversible.

This will also remove all records within the zone.

Search DNS records within a BIND zone

Create or delete a DNS record within a BIND zone

Get the current BIND DNS server settings

Update BIND DNS server settings

Search BIND access control lists

Create or delete a BIND access control list

Search FreeRADIUS users with filtering and pagination

Requires the FreeRADIUS package to be installed on pfSense.

Create a FreeRADIUS user

Update an existing FreeRADIUS user by ID

Delete a FreeRADIUS user by ID. WARNING: This is irreversible.

Search FreeRADIUS clients (NAS devices) with filtering and pagination

Create a FreeRADIUS client (NAS device)

Update an existing FreeRADIUS client by ID

Delete a FreeRADIUS client by ID. WARNING: This is irreversible.

Search HAProxy backends with filtering and pagination

Requires the HAProxy package to be installed on pfSense.

Create an HAProxy backend pool

Update an existing HAProxy backend by ID

Delete an HAProxy backend by ID. WARNING: This is irreversible.

Search servers within an HAProxy backend

Add or remove a server from an HAProxy backend

Search HAProxy frontends with filtering and pagination

Create an HAProxy frontend listener

Update an existing HAProxy frontend by ID

Delete an HAProxy frontend by ID. WARNING: This is irreversible.

List the bind addresses configured on an HAProxy frontend

Add or remove a bind address from an HAProxy frontend

List the additional SNI SSL certificates bound to an HAProxy frontend

Note: this lists the frontend's additional SNI certificates (ha_certificates), not its default certificate. The default certificate is the frontend's ssloffloadcert field, set via update_haproxy_frontend and visible in search_haproxy_frontends.

Add or remove an additional SNI SSL certificate on an HAProxy frontend

To set the frontend's default certificate instead (used whenever SNI doesn't match one of these additional certs), use update_haproxy_frontend's ssloffloadcert parameter.

Search HAProxy files (certificates, error pages, Lua scripts, etc.)

Create or delete an HAProxy file (certificate, error page, Lua script, etc.)

Get the current HAProxy service settings

Update HAProxy service settings

Apply pending HAProxy configuration changes

Use this after making changes with apply_immediately=False to batch-apply them.

Search routing gateways with filtering and pagination

Create a routing gateway

Update an existing routing gateway by ID

Delete a routing gateway by ID. WARNING: This is irreversible.

Get the current default gateway settings (IPv4 and IPv6)

Update the default gateway settings

Search gateway groups with filtering and pagination

Create a gateway group for multi-WAN failover or load balancing

Update an existing gateway group by ID

Delete a gateway group by ID. WARNING: This is irreversible.

Search static routes with filtering and pagination

Create a static route

Update an existing static route by ID

Delete a static route by ID. WARNING: This is irreversible.

Apply pending routing changes (gateways, static routes, gateway groups)

Use this after making changes with apply_immediately=False to batch-apply them.

Get real-time gateway status including latency, packet loss, and online/offline state

Search and filter system services

Start, stop, or restart a service on the live pfSense appliance.

WARNING: Stopping critical services (dhcpd, unbound, sshd) will disrupt network operations.

Get current system status including CPU, memory, disk usage, and version info

Search and filter network interfaces with advanced options

Find interfaces by their current status

Get the ARP table to discover devices on the network.

Shows IP-to-MAC address mappings for all devices that have recently communicated on the network, including those without static DHCP mappings.

Get the current system timezone setting

Update the system timezone

Get the system console settings

Update the system console settings

Get the WebGUI settings (protocol, port, certificates, etc.)

Update the WebGUI settings

Get the email notification settings

Update the email notification settings

Get the system log settings

Update the system log settings

The pfSense REST API field names are mirrored verbatim. Note that to actually enable Remote Syslog you must set enableremotelogging=True — setting remoteserver/ipprotocol alone leaves the feature off and pfSense will normalise the remote-* fields back to null.

Get the DHCP relay settings

Update the DHCP relay settings

Update firewall advanced settings

Update the firewall state table size

Get the current system DNS server configuration

Update system DNS server settings

Get the current system hostname and domain

Update the system hostname and/or domain

Search system tunables (sysctl values) with filtering and pagination

Create a system tunable (sysctl value)

Update an existing system tunable by ID

Delete a system tunable by ID. WARNING: This is irreversible.

Get the pfSense system version information

Get the current CARP (Common Address Redundancy Protocol) status

Update CARP maintenance mode settings

Search installed packages with filtering and pagination

Search traffic shapers with filtering and pagination

Create a traffic shaper on an interface

Update an existing traffic shaper by ID

Delete a traffic shaper by ID. WARNING: This is irreversible.

Search traffic shaper queues with filtering and pagination

Create a traffic shaper queue

Update an existing shaper queue by ID

Delete a shaper queue by ID. WARNING: This is irreversible.

Search traffic limiters (dummynet pipes) with filtering and pagination

Create a traffic limiter (dummynet pipe)

Update an existing traffic limiter by ID

Delete a traffic limiter by ID. WARNING: This is irreversible.

Test connectivity to a host from the pfSense appliance.

Runs ping, checks the ARP table for the target IP, and checks gateway status to give a combined connectivity diagnosis.

Comprehensive analysis of why traffic might be blocked.

Searches firewall logs for the source IP, finds matching block/reject rules, checks alias memberships, and suggests fixes.

Analyze an interface for problems.

Checks interface status, configuration, gateway status, and ARP entries on the specified interface.

Comprehensive VPN health check across all VPN types.

Gets status for OpenVPN servers, OpenVPN clients, IPsec SAs, and WireGuard peers. Returns per-VPN summary with connected/disconnected/error counts.

Analyze DHCP service health on an interface.

Checks DHCP server config, lease pool utilization, IP conflicts, and optionally looks up a specific MAC or IP address.

Check DNS resolver health.

Gets DNS resolver settings, host/domain override counts, system DNS servers, and runs a connectivity check to verify upstream reachability.

Comprehensive service health check.

Gets all services and their status, identifies stopped services, and checks system resource utilization (CPU, memory, disk).

Check CARP/HA status if configured.

Gets CARP status, virtual IPs, and checks if any CARP VIPs are in an unexpected state (e.g., backup when they should be master).

Full system health dashboard — combines all diagnostics into one report.

Checks system status, interface health, service status, gateway status, VPN status, DHCP utilization, recent blocked traffic, and firewall rule counts. Returns severity-coded findings.

Search the guardrail audit log for recent destructive actions taken.

Checks the in-memory rollback history and, if MCP_AUDIT_LOG is configured, reads recent entries from the audit log file.

Search pfSense local users with optional filtering and pagination

Create a new pfSense local user

Update an existing pfSense local user by ID

Delete a pfSense local user by ID. WARNING: This is irreversible.

Search pfSense user groups with optional filtering and pagination

Create a new pfSense user group

Update an existing pfSense user group by ID

Delete a pfSense user group by ID. WARNING: This is irreversible.

Search pfSense authentication servers (LDAP, RADIUS) with optional filtering

Create a new authentication server (LDAP or RADIUS)

Update an existing authentication server by ID

Delete a pfSense authentication server by ID. WARNING: This is irreversible.

Follow a HATEOAS link from a previous API response

Enable HATEOAS links in API responses on the pfSense server.

WARNING: This modifies the pfSense REST API server-wide setting via PATCH /system/restapi/settings. It affects ALL API consumers, not just this MCP session.

Disable HATEOAS links in API responses on the pfSense server.

WARNING: This modifies the pfSense REST API server-wide setting via PATCH /system/restapi/settings. It affects ALL API consumers, not just this MCP session.

Refresh object IDs by re-querying an endpoint (handles ID changes after deletions).

pfSense object IDs are non-persistent array indices that change after any deletion. Call this before performing update/delete operations to get fresh IDs.

Find an object by a specific field value (safer than using IDs).

Use this instead of IDs when you need a stable reference to an object, since pfSense object IDs change after deletions.

Get comprehensive API capabilities and configuration

Test enhanced API connection with feature validation

Get the current guardrail configuration and recent action history.

Shows risk classification for tools, rate limits, allowlist status, and recent rollback entries for destructive operations.

Check the risk classification and guardrail requirements for a tool.

Search virtual IPs with filtering and pagination

Create a virtual IP address

Update an existing virtual IP by ID

Delete a virtual IP by ID. WARNING: This is irreversible.

Apply pending virtual IP changes

Use this after making changes with apply_immediately=False to batch-apply them.

Search IPsec Phase 2 encryption entries with filtering and pagination

Create an IPsec Phase 2 encryption entry

Update an existing IPsec Phase 2 encryption entry by ID

Delete an IPsec Phase 2 encryption entry by ID. WARNING: This is irreversible.

Search WireGuard tunnel addresses with filtering and pagination

Add or remove an address for a WireGuard tunnel

Get the status of all OpenVPN servers

Get the status of all OpenVPN clients

Search active OpenVPN server connections

Disconnect an active OpenVPN client connection. WARNING: This will terminate the client session.

Search OpenVPN server routing table entries

Search available OpenVPN client export configurations

Search IPsec Phase 1 (IKE) entries with filtering and pagination

Create an IPsec Phase 1 (IKE) entry

Update an existing IPsec Phase 1 (IKE) entry by ID

Delete an IPsec Phase 1 (IKE) entry by ID. WARNING: This is irreversible and will also remove associated Phase 2 entries.

Search IPsec Phase 2 (Child SA / tunnel) entries with filtering and pagination

Create an IPsec Phase 2 (Child SA / tunnel) entry

Update an existing IPsec Phase 2 (Child SA / tunnel) entry by ID

Delete an IPsec Phase 2 (Child SA / tunnel) entry by ID. WARNING: This is irreversible.

Search IPsec Phase 1 encryption algorithm entries with filtering and pagination

Create an IPsec Phase 1 encryption algorithm entry

Delete an IPsec Phase 1 encryption algorithm entry by ID. WARNING: This is irreversible.

Apply pending IPsec configuration changes to the live system.

Call this after making IPsec configuration changes with apply_immediately=False to activate them all at once.

Get IPsec Security Associations (SAs) status showing active tunnels and their state.

Returns the current state of all IPsec IKE SAs including connection status, established time, local/remote identities, and child SA counts.

Get IPsec Child Security Associations status showing active tunnel details.

Returns detailed status of all IPsec Child SAs including traffic selectors, bytes transferred, encryption/integrity algorithms in use, and uptime.

Search OpenVPN server instances with filtering and pagination.

Create an OpenVPN server instance on pfSense.

Update an existing OpenVPN server instance by ID.

Delete an OpenVPN server instance by ID. WARNING: This is irreversible.

Search OpenVPN client instances with filtering and pagination.

Create an OpenVPN client instance on pfSense.

Update an existing OpenVPN client instance by ID.

Delete an OpenVPN client instance by ID. WARNING: This is irreversible.

Search OpenVPN Client Specific Overrides (CSOs) with filtering and pagination.

CSOs allow per-client configuration overrides such as static IPs, custom routes, and pushed settings.

Create, update, or delete an OpenVPN Client Specific Override (CSO).

CSOs allow per-client configuration such as assigning static tunnel IPs, pushing custom routes, or blocking specific clients.

Get the runtime status of all OpenVPN server and client instances.

Returns connection status, connected clients, traffic statistics, and uptime information for all active OpenVPN tunnels.

Export an OpenVPN client configuration file or installer package.

Generates downloadable client configuration for connecting to a pfSense OpenVPN server instance.

Search WireGuard tunnels with filtering and pagination

Create a new WireGuard tunnel

Update an existing WireGuard tunnel by ID

Delete a WireGuard tunnel by ID. WARNING: This is irreversible.

Search WireGuard peers with filtering and pagination

Create a new WireGuard peer on a tunnel

Update an existing WireGuard peer by ID

Delete a WireGuard peer by ID. WARNING: This is irreversible.

Search WireGuard peer allowed IPs with filtering and pagination

Add or remove an allowed IP for a WireGuard peer

Get the current WireGuard service settings

Update WireGuard service settings

Apply pending WireGuard configuration changes

Sends a POST to the WireGuard apply endpoint to activate any pending tunnel, peer, or settings changes.