mcp-opnsense

List all DNS host overrides (A/AAAA/CNAME records) configured in Unbound

Add a DNS host override (A/AAAA/CNAME record) to Unbound. Run opnsense_dns_apply afterwards to activate.

Delete a DNS host override by UUID. Run opnsense_dns_apply afterwards to activate.

List all DNS-over-TLS forwarding servers configured in Unbound

Add a DNS forwarding server (DNS-over-TLS). Run opnsense_dns_apply afterwards to activate.

Delete a DNS forwarding entry by UUID. Run opnsense_dns_apply afterwards to activate.

List all domain overrides (used for domain blocking) in Unbound

Block a domain by adding a domain override with an empty server. Run opnsense_dns_apply afterwards to activate.

Unblock a domain by deleting its domain override. Run opnsense_dns_apply afterwards to activate.

Flush the Unbound DNS cache and DNSBL data

Dump the current Unbound DNS cache for diagnostic purposes

Apply pending DNS/Unbound configuration changes (reconfigure service)

List all firewall filter rules

Add a new firewall filter rule. Run opnsense_fw_apply afterwards to activate.

Update an existing firewall filter rule by UUID. Run opnsense_fw_apply afterwards to activate.

Delete a firewall filter rule by UUID. Run opnsense_fw_apply afterwards to activate.

Enable or disable a firewall rule by UUID. Run opnsense_fw_apply afterwards to activate.

List all firewall aliases (host groups, networks, ports, URLs)

Create, update, or delete a firewall alias. Run opnsense_fw_apply afterwards to activate.

Apply pending firewall configuration changes

Show the ARP table (IP-to-MAC mappings). Optionally filter by IP, MAC, or interface.

Show the routing table

Ping a host from the OPNsense firewall

Run a traceroute from the OPNsense firewall to a destination

Perform a DNS lookup from the OPNsense firewall

Perform a reverse DNS lookup (IP to hostname) from the OPNsense firewall

List active firewall connection tracking states

Retrieve recent firewall log entries

Get system status information (CPU, memory, uptime, disk, versions)

List all network interface names and their device mappings

Get detailed configuration for a specific network interface (IP addresses, status, MTU, etc.)

Get traffic statistics for all interfaces (bytes, packets, errors, collisions)

List all current DHCPv4 leases

Search DHCPv4 leases by IP address, MAC address, or hostname

List all static DHCP mappings (MAC-to-IP reservations). Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detected.

Add a static DHCP mapping (MAC-to-IP reservation). Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detected. Requires DHCP service restart to take effect.

Delete a static DHCP mapping by UUID. Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detected.

Get system status information (hostname, versions, CPU, memory, uptime, disk usage)

List all configuration backups stored on the OPNsense filesystem with timestamps, descriptions, and file sizes

Download an OPNsense configuration backup as XML. Downloads the current running config if no backup_id is specified.

Revert OPNsense configuration to a previous backup. DESTRUCTIVE: replaces the running config with the specified backup.

List all certificates in the OPNsense trust store with their refids, descriptions, and validity dates

List all services and their running status

Start, stop, or restart a service by name

List all ACME accounts (Let's Encrypt, ZeroSSL, etc.) configured in the os-acme-client plugin

Register a new ACME account with a certificate authority (Let's Encrypt, ZeroSSL, etc.). Run opnsense_acme_apply afterwards.

Delete an ACME account by UUID. Run opnsense_acme_apply afterwards.

Trigger registration of an ACME account with its certificate authority. Use after adding an account to verify it registers successfully.

List all configured ACME challenge/validation methods (DNS-01, HTTP-01, etc.)

Add a DNS-01 challenge configuration for automated certificate validation. For Cloudflare, use the dedicated dns_cf_* fields instead of dns_environment. Run opnsense_acme_apply afterwards.

Update an existing ACME challenge/validation by UUID. Use to change credentials or settings. Run opnsense_acme_apply afterwards.

Delete an ACME challenge/validation method by UUID. Run opnsense_acme_apply afterwards.

List all ACME certificates and their status (issued, pending, expired)

Create a new ACME certificate request. Requires an account and challenge to be configured first. Run opnsense_acme_apply afterwards.

Delete an ACME certificate by UUID. Run opnsense_acme_apply afterwards.

Trigger immediate renewal/signing of an ACME certificate by UUID

Get or update ACME service settings (enable/disable, environment, auto-renewal, log level). When called with no parameters, returns current settings. Run opnsense_acme_apply afterwards when updating.

Apply pending ACME configuration changes (reconfigure service)

Get firmware version, architecture, and update status of the OPNsense system

Check for available firmware upgrades and their status (running, pending, done)

List all available and installed OPNsense plugins with their versions and status

Install an OPNsense plugin package by name (e.g. 'os-acme-client'). May require a service restart.

Remove an installed OPNsense plugin package. DESTRUCTIVE: requires explicit confirmation.